The OpenFaaS Gateway registers a GET /system/telemetry route in its main handler. When basic_auth is enabled, most administrative /system/* handlers are wrapped with authentication, but the telemetry handler was omitted from that block in versions 0.27.11 to 0.27.13. As a result, unauthenticated clients can reach the forwarding proxy that serves telemetry data and read the provider's metrics or cluster state without any credentials. The flaw is a classic missing authentication weakness (CWE‑306).

The affected product is OpenFaaS Gateway from the openfaas:faas vendor. Versions 0.27.11 through 0.27.13 contain the missing authentication logic. Versions prior to 0.27.11 or 0.27.14 and newer are not affected. The route is exposed on the gateway port, accessible to any host that can reach the service.

The CVSS score assigned to this vulnerability is 6.9, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because an attacker only needs an unauthenticated GET request on the gateway port, the condition for exploitation is very low. The exposed information—resource and invocation metrics or cluster state—depends on the telemetry provider but can reveal sensitive operational data to anyone who can reach the gateway.