CVE-2026-102339

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102339", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-28T22:38:42.254Z", "datePublished": "2026-11-04T20:35:34.030Z", "dateUpdated": "2026-11-09T16:59:56.924Z"}, "containers": {"cna": {"title": "Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof \u2014 active client sessions hijackable", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/telepresenceio/telepresence/security/advisories/GHSA-6j3h-rp73-6rvf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/telepresenceio/telepresence/security/advisories/GHSA-6j3h-rp73-6rvf"}, {"name": "https://github.com/telepresenceio/telepresence/pull/4217", "tags": ["x_refsource_MISC"], "url": "https://github.com/telepresenceio/telepresence/pull/4217"}, {"name": "https://github.com/telepresenceio/telepresence/commit/1312482488b771742dbedd3015f9a81a27532de6", "tags": ["x_refsource_MISC"], "url": "https://github.com/telepresenceio/telepresence/commit/1312482488b771742dbedd3015f9a81a27532de6"}, {"name": "https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9", "tags": ["x_refsource_MISC"], "url": "https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9"}, {"name": "https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0"}], "affected": [{"vendor": "telepresenceio", "product": "telepresence", "versions": [{"version": "< 2.31.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T20:35:34.030Z"}, "descriptions": [{"lang": "en", "value": "Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0."}], "source": {"advisory": "GHSA-6j3h-rp73-6rvf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T16:11:38.687798Z", "id": "CVE-2026-102339", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:59:56.924Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102339", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-09T16:11:38.687798Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:11:39.780Z"}}], "cna": {"title": "Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof \u2014 active client sessions hijackable", "source": {"advisory": "GHSA-6j3h-rp73-6rvf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "telepresenceio", "product": "telepresence", "versions": [{"status": "affected", "version": "< 2.31.0"}]}], "references": [{"url": "https://github.com/telepresenceio/telepresence/security/advisories/GHSA-6j3h-rp73-6rvf", "name": "https://github.com/telepresenceio/telepresence/security/advisories/GHSA-6j3h-rp73-6rvf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/telepresenceio/telepresence/pull/4217", "name": "https://github.com/telepresenceio/telepresence/pull/4217", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/telepresenceio/telepresence/commit/1312482488b771742dbedd3015f9a81a27532de6", "name": "https://github.com/telepresenceio/telepresence/commit/1312482488b771742dbedd3015f9a81a27532de6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9", "name": "https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0", "name": "https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T20:35:34.030Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102339", "state": "PUBLISHED", "dateUpdated": "2026-11-09T16:59:56.924Z", "dateReserved": "2026-09-28T22:38:42.254Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-04T20:35:34.030Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "telepresence", "vendor": "telepresenceio", "versions": [{"status": "affected", "version": "< 2.31.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0."}], "id": "CVE-2026-102339", "lastModified": "2026-11-12T20:04:52.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102339", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T16:11:38.687798Z", "version": "2.0.3"}}]}, "published": "2026-11-04T21:17:40.500", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/telepresenceio/telepresence/commit/1312482488b771742dbedd3015f9a81a27532de6"}, {"source": "security-advisories@github.com", "url": "https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9"}, {"source": "security-advisories@github.com", "url": "https://github.com/telepresenceio/telepresence/pull/4217"}, {"source": "security-advisories@github.com", "url": "https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/telepresenceio/telepresence/security/advisories/GHSA-6j3h-rp73-6rvf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/telepresenceio/telepresence: Telepresence: Unauthorized network routing access via missing session ownership verification", "id": "2567449", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567449"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-639", "details": ["Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0.", "A flaw was found in Telepresence. The Traffic Manager Tunnel service processes session identifiers from caller-controlled messages without verifying that the caller owns the active session. An attacker who obtains a valid session identifier can connect to the tunnel endpoint to hijack another user's session, gaining unauthorized network routing access within the connected cluster."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-102339", "public_date": "2026-11-04T20:35:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102339\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102339\nhttps://github.com/telepresenceio/telepresence/commit/1312482488b771742dbedd3015f9a81a27532de6\nhttps://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9\nhttps://github.com/telepresenceio/telepresence/pull/4217\nhttps://github.com/telepresenceio/telepresence/releases/tag/v2.31.0\nhttps://github.com/telepresenceio/telepresence/security/advisories/GHSA-6j3h-rp73-6rvf"], "statement": "This vulnerability is rated as Important severity because successful exploitation allows authenticated users to hijack active developer tunnels, bypassing network segmentation and gaining lateral cluster routing privileges. Although discovering an active session token requires prerequisites like log leakage or internal endpoint exposure rather than blind brute-force attacks, the resulting access grants the full routing capabilities of the compromised session across the cluster environment. Red Hat OpenShift and enterprise environments do not include Telepresence by default, restricting exposure to developer workflows where this tooling is explicitly integrated.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.31.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "telepresence", "source": "cna", "vendor": "telepresenceio"}, "product": "telepresence", "vendor": "telepresenceio"}], "created": "2026-11-04T21:30:09.550815+00:00", "updated": "2026-11-06T21:28:40.346218+00:00", "vendors": ["telepresenceio", "telepresenceio$PRODUCT$telepresence"]}