CVE-2026-81664

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81664
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81664.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81664
Published
2026-08-27T14:50:43.397Z
Modified
2026-09-01T03:30:42.498858755Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenFaaS Gateway 0.27.11 through 0.27.13 Missing Authentication on the /system/telemetry Route
Details

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basicauth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added it. On an affected gateway the route therefore reaches the forwarding proxy with no credential check and returns whatever the configured provider serves for /system/telemetry, so any client that can reach the gateway port can read the provider's telemetry regardless of the basicauth setting. The exposed content depends on the provider, and covers resource and invocation metrics for faasd and pod or cluster state for faas-netes.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81664.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-306"
    ]
}
References

Affected packages

Git / github.com/openfaas/faas

Affected ranges

Type
GIT
Repo
https://github.com/openfaas/faas
Events
Introduced
2fb748e03d58568309f516c215c6f2be17bf667c
Fixed
8d803bf9e2655aec6a60fd0e25b392839f96af95
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.27.11"
        },
        {
            "fixed": "0.27.14"
        }
    ]
}

Affected versions

0.*
0.27.11
0.27.12
0.27.13

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81664.json"