Tetragon, an eBPF-based security observability tool, contains a flaw that exposes its privileged gRPC administration API on a TCP listener when deployed with the default Helm configuration. The unsecured endpoint allows any hostNetwork pod on the same node to invoke privileged operations such as adding, deleting, or reconfiguring tracing policies and adjusting debug settings. These operations are not authenticated, giving an attacker the ability to gain elevated privileges or escape from a container, effectively compromising the host system.

The vulnerability affects Cilium Tetragon installations with versions prior to 1.7.0. Deployments using the default Helm chart that expose the gRPC API on localhost:54321 are at risk; instances configured to use the Unix-domain socket introduced in 1.7.0 are not affected.

With a CVSS score of 8.8, this issue is categorized as high severity. The EPSS score is not available, but the KEV catalog does not list it as a known exploited vulnerability. The attack vector is local; it requires an attacker to run an pod with hostNetwork enabled on the same node, or to compromise such a pod. No additional authentication or controls are in place, making the exploitation path straightforward once the attacker’s pod can reach the exposed port. The potential impact ranges from privilege escalation to container escape.