Skip to main content

OpenFaaS Gateway EUVDEUVD-2026-67033

| CVE-2026-81664 MEDIUM
Missing Authentication for Critical Function (CWE-306)
2026-08-27 VulnCheck GHSA-gwq3-cphc-pwmg
Authentication Bypass Faas
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable and requires no privileges when basic_auth is enabled; confidentiality impact is low (telemetry metrics only) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 27, 2026 - 18:16 vuln.today
Analysis Generated
Aug 27, 2026 - 18:16 vuln.today

DescriptionCVE.org

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added it. On an affected gateway the route therefore reaches the forwarding proxy with no credential check and returns whatever the configured provider serves for /system/telemetry, so any client that can reach the gateway port can read the provider's telemetry regardless of the basic_auth setting. The exposed content depends on the provider, and covers resource and invocation metrics for faasd and pod or cluster state for faas-netes.

AnalysisAI

OpenFaaS gateway versions 0.27.11 through 0.27.13 expose the administrative GET /system/telemetry route without authentication even when basic_auth is enabled, allowing any network-reachable client to retrieve provider telemetry data without credentials. The TelemetryHandler was omitted from the auth.DecorateWithBasicAuth wrapper applied to all other /system/* routes - confirmed by fix commit 8d803bf9 in the official repository. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify reachable OpenFaaS gateway port
Delivery
Send unauthenticated GET /system/telemetry request
Exploit
Bypass missing auth.DecorateWithBasicAuth wrapper
Execution
Receive provider telemetry response
Impact
Enumerate function invocation metrics and cluster state
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Three conditions must all be true for exploitation to be meaningful: (1) the OpenFaaS gateway is running version 0.27.11, 0.27.12, or 0.27.13 - no other versions are affected; (2) the gateway is configured with basic_auth enabled - without basic_auth, /system/* routes are already unauthenticated by design and there is no authentication bypass to exploit; (3) the attacker can reach the gateway's HTTP port from their network position, whether via internet exposure or internal network access. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) accurately characterizes this as a low-confidentiality-impact, unauthenticated, network-exploitable flaw - consistent with an information disclosure rather than a code execution or integrity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach the OpenFaaS gateway HTTP port issues an unauthenticated HTTP GET request to /system/telemetry, receiving a full telemetry response from the configured backend provider without supplying any credentials. For faas-netes deployments, this response may include pod names, Kubernetes namespace state, and function invocation counts that assist subsequent lateral movement or targeted function abuse. …
Remediation Upgrade the OpenFaaS gateway to version 0.27.14 or later, which corrects the missing authentication wrapper via commit 8d803bf9e2655aec6a60fd0e25b392839f96af95 (https://github.com/openfaas/faas/commit/8d803bf9e2655aec6a60fd0e25b392839f96af95). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2024-51567 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-32433 CRITICAL POC
10.0
CVE-2016-2004 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-67033 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy