Telepresence, a tool for local development against remote Kubernetes or OpenShift clusters, contains a flaw in its Traffic Manager gRPC API that listens on port 8081. The API accepts requests without verifying the caller’s identity. When an attacker registers with any pod that can reach the manager, the system stores a caller‑supplied namespace in the manager’s watchlist and allows creation of intercepts in any managed namespace without checking the Kubernetes RBAC session. This grants the attacker the ability to receive intercepted traffic and access the victim pod’s complete container environment, including secrets, tokens and API keys.

All Telepresence releases before version 2.31.0 are vulnerable. The default cluster‑wide deployment manages every namespace, so any pod within the cluster network that can reach the manager can exploit the vulnerability.

The vulnerability has a CVSS score of 8.5, indicating a high severity. No EPSS score is available, and it is not listed in the CISA KEV catalog. The likely attack vector is an attacker operating any pod with network access to the Telepresence manager, enabling them to claim an arbitrary namespace, set up intercepts, receive traffic, and exfiltrate secrets. The lack of authentication and authorization makes exploitation straightforward for anyone who can reach the Traffic Manager service.