Telepresence Traffic Manager gRPC lacks authentication, exposing pod secrets
A Kubernetes development tool lets other pods steal passwords and keys.
Summary
The Telepresence Traffic Manager gRPC API accepts unauthenticated calls from the cluster network, so an attacker can take a victim pod's environment, including secrets, tokens and API keys. Versions before 2.31.0 are affected.
Affected when
- Traffic Manager gRPC port 8081 reachable from the cluster network
- Default cluster-wide deployment managing all namespaces
What to do
Update Telepresence to 2.31.0 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen