CVE-2026-81664 openfaas CVE debrief

Who should care

OpenFaaS users, administrators, and security teams should review their gateway configurations and versions to assess potential exposure. They should verify basic_auth settings and telemetry route accessibility, and consider upgrading to OpenFaaS gateway version 0.27.14 or later. Monitoring for unusual telemetry data access or exposure is also recommended. Additionally, implementing compensating controls for sensitive telemetry data may be necessary. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. This issue may impact operators, platforms, and vulnerability management processes, requiring coordinated review and mitigation efforts across multiple teams.

Technical summary

The OpenFaaS gateway registers a GET /system/telemetry route without proper authentication in versions 0.27.11 through 0.27.13. This allows any client reaching the gateway port to read telemetry data, including resource and invocation metrics, regardless of basic_auth settings. The issue was resolved in version 0.27.14 by adding authentication to the TelemetryHandler. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added it. On an affected gateway the route therefore reaches the forwarding proxy with no credential check and returns whatever the configured provider serves for /system/telemetry, so any client that can reach the gateway port can read the provider's telemetry regardless of the basic_auth setting.

Defensive priority

Medium-priority defensive review recommended due to exposed telemetry data.

Recommended defensive actions

• Review OpenFaaS gateway version and configuration for potential exposure
• Verify basic_auth settings and telemetry route accessibility
• Consider upgrading to OpenFaaS gateway version 0.27.14 or later
• Monitor for unusual telemetry data access or exposure
• Implement compensating controls for sensitive telemetry data

Evidence notes

Evidence from official CVE and NVD records, plus source references, indicates a telemetry exposure issue in OpenFaaS gateway versions 0.27.11 through 0.27.13. Defensive verification tasks are recommended to confirm affected versions and configurations. The exposed content depends on the provider, and covers resource and invocation metrics for faasd and pod or cluster state for faas-netes. TelemetryHandler was left out of the auth wrap block from 0.27.11, which introduced the route, until 0.27.14, which added it.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.