{"affected":[{"product":"telepresence","source":"CNA: GitHub_M","vendor":"telepresenceio","versions":[{"status":"affected","version":"< 2.31.0"}]}],"cveId":"CVE-2026-102339","cwes":["CWE-639"],"description":"Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without verifying that the caller owns the active session. An attacker who obtains a valid active session ID through log leakage, cluster-internal channels, or the unauthenticated ArriveAsClient endpoint can attach a routed tunnel to that session and gain its network routing capabilities. UUID4 session IDs make cold brute force impractical. This vulnerability is fixed in 2.31.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1793824534030,"publishedAt":1793824534030,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/telepresenceio/telepresence/security/advisories/GHSA-6j3h-rp73-6rvf"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/telepresenceio/telepresence/pull/4217"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/telepresenceio/telepresence/commit/1312482488b771742dbedd3015f9a81a27532de6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/telepresenceio/telepresence/commit/36458b65a010d2b316af48cd90e193ba190785d9"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/telepresenceio/telepresence/releases/tag/v2.31.0"}],"remediation":[],"revision":"51cbc4d2070978f39791d6ff3d0b6afa70a8c9a0e0343692d66f6f6f49088fff","sources":[{"modifiedAt":1793824534030,"name":"CNA: GitHub_M","retrievedAt":1793826508529,"url":"https://www.cve.org/CVERecord?id=CVE-2026-102339"}],"ssvc":null,"status":"published","title":"Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable","updatedAt":1793826508529}