CVE-2026-81664 OpenFaaS Gateway 0.27.11 through 0.27.13 Missing Authentication on the /system/telemetry Route
Unauthenticated attackers can access telemetry data via the /system/telemetry route, exposing resource metrics and cluster state.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81664?
CVE-2026-81664 is a medium-severity missing authorization vulnerability in openfaas faas, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added it. On an affected gateway the route therefore reaches the forwarding proxy with no credential check and returns whatever the configured provider serves for /system/telemetry, so any client that can reach the gateway port can read the provider's telemetry regardless of the basic_auth setting. The exposed content depends on the provider, and covers resource and invocation metrics for faasd and pod or cluster state for faas-netes.
Weakness: CWE-306
Which versions are affected by CVE-2026-81664?
How do I fix CVE-2026-81664?
No fix has been published for CVE-2026-81664 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-81664 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81664 exists.
Sources
Also known as GHSA-gwq3-cphc-pwmg.