Faas
Monthly
OpenFaaS gateway versions 0.27.11 through 0.27.13 expose the administrative GET /system/telemetry route without authentication even when basic_auth is enabled, allowing any network-reachable client to retrieve provider telemetry data without credentials. The TelemetryHandler was omitted from the auth.DecorateWithBasicAuth wrapper applied to all other /system/* routes - confirmed by fix commit 8d803bf9 in the official repository. No active exploitation is confirmed (not in CISA KEV), though a researcher advisory is publicly available and a patch exists in version 0.27.14.
OpenFaaS gateway versions 0.27.11 through 0.27.13 expose the administrative GET /system/telemetry route without authentication even when basic_auth is enabled, allowing any network-reachable client to retrieve provider telemetry data without credentials. The TelemetryHandler was omitted from the auth.DecorateWithBasicAuth wrapper applied to all other /system/* routes - confirmed by fix commit 8d803bf9 in the official repository. No active exploitation is confirmed (not in CISA KEV), though a researcher advisory is publicly available and a patch exists in version 0.27.14.