CVE-2026-81664

Name of the Vulnerable Software and Affected Versions OpenFaaS gateway versions 0.27.11 through 0.27.13

Description The OpenFaaS gateway registers the 'GET /system/telemetry' endpoint in gateway/main.go. When basic authentication is enabled, administrative handlers under /system/* are typically wrapped in auth.DecorateWithBasicAuth to ensure credential checks. However, the TelemetryHandler function was omitted from this wrap block. Consequently, the endpoint reaches the forwarding proxy without authentication, allowing any client with access to the gateway port to read the provider's telemetry. The exposed data varies by provider, including resource and invocation metrics for faasd or pod and cluster state for faas-netes.

Recommendations Update OpenFaaS gateway to version 0.27.14 or later.