CVE-2026-65960

Name of the Vulnerable Software and Affected Versions Tetragon versions prior to 1.7.0

Description Tetragon uses a Helm default that exposes the privileged gRPC API through an unauthenticated TCP listener on localhost:54321. An attacker who can run or compromise pods with hostNetwork: true on the same node can access this listener and invoke privileged methods without authentication. This allows the attacker to add, delete, or reconfigure TracingPolicy and modify debug settings. Such actions can be used to disable security observability, potentially leading to privilege escalation or container escape.

Recommendations Update to version 1.7.0 or later. As a temporary mitigation, ensure that deployments do not expose an unauthenticated TCP listener.