Auth bypass in Openfaas Faas
CVE-2026-81664
The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added it. On an affected gateway the route therefore reaches the forwarding proxy with no credential check and returns whatever the configured provider serves for /system/telemetry, so any client that can reach the gateway port can read the provider's telemetry regardless of the basic_auth setting. The exposed content depends on the provider, and covers resource and invocation metrics for faasd and pod or cluster state for faas-netes.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (28.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 28.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
Weakness classification (CWE)
References
- github.com/geo-chen/oss/blob/main/faas.md (third-party-advisory)
- github.com/openfaas/faas (product)
- github.com/openfaas/faas/commit/8d803bf9e2655aec6a60fd0e25b392839f96af95 (patch)
- github.com/openfaas/faas/blob/0.27.13/gateway/main.go (technical-description)
- www.vulncheck.com/advisories/openfaas-gateway-0.27.11-through-0.27.13-missing-a… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-81664?
- CVE-2026-81664 is a medium-severity vulnerability in Openfaas Faas, classified under Missing Authentication for Critical Function. CVSS score: 5.3/10. Published 2026-08-27.
- How severe is CVE-2026-81664?
- Medium severity. CVSS v3 base score is 5.3 out of 10.