CVE-2026-81664: OpenFaaS Gateway 0.27.11 through 0.27.13 Missing Authentication on the /system/telemetry Route
The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basicauth is enabled, wraps each administrative /system/ handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added it. On an affected gateway the route therefore reaches the forwarding proxy with no credential check and returns whatever the configured provider serves for /system/telemetry, so any client that can reach the gateway port can read the provider's telemetry regardless of the basicauth setting. The exposed content depends on the provider, and covers resource and invocation metrics for faasd and pod or cluster state for faas-netes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenFaaS Gatewayto a version that resolves this vulnerability.Fixed in 0.27.14 - Compensating control
Restrict network access to the OpenFaaS gateway port so only trusted clients can reach the gateway (to prevent unauthenticated reads of /system/telemetry regardless of basic_auth setting) until upgraded to 0.27.14.
Event History
Frequently Asked Questions
Which deployments are exposed?
Gateway versions 0.27.11 through 0.27.13 are affected if an unauthenticated client can reach the gateway port. The issue remains reachable even when basic_auth is enabled, because that setting did not protect this route in affected versions.
What can an unauthenticated attacker obtain?
An attacker only needs network access to send a GET request to /system/telemetry. The response contains whatever telemetry the configured provider exposes, including resource and invocation metrics for faasd or pod and cluster state for faas-netes.
How can I determine whether my gateway is affected?
Check whether the gateway version is between 0.27.11 and 0.27.13 inclusive. On an affected deployment, an unauthenticated request to GET /system/telemetry can reach the provider forwarding proxy and return telemetry.
What should be done if upgrading is not immediately possible?
Restrict network access to the gateway port so untrusted clients cannot reach it. This limits unauthenticated access to /system/telemetry until the gateway is updated to 0.27.14 or later.