Description

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added it. On an affected gateway the route therefore reaches the forwarding proxy with no credential check and returns whatever the configured provider serves for /system/telemetry, so any client that can reach the gateway port can read the provider's telemetry regardless of the basic_auth setting. The exposed content depends on the provider, and covers resource and invocation metrics for faasd and pod or cluster state for faas-netes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-27T17:20:55.970Z",
  "pubdate": "2026-08-27T17:20:55.970Z",
  "executiveSummary": "This vulnerability is an authentication bypass in the OpenFaaS gateway, specifically affecting the /system/telemetry endpoint. It is classified as an authorization control failure where administrative handlers fail to inherit mandatory basic authentication wrappers.\nThe flaw exists within the gateway/main.go implementation, where the TelemetryHandler was omitted from the auth.DecorateWithBasicAuth decorator logic. This exposure persists even when basic_auth is explicitly enabled, allowing unauthorized actors to query the gateway for sensitive telemetry data.\nThe impact is significant, as it enables unauthenticated remote attackers to access internal cluster state, resource consumption metrics, and invocation statistics. Depending on the backend provider (faasd or faas-netes), the telemetry output can reveal sensitive infrastructure topology and workload performance metrics.\nAffected systems include OpenFaaS gateway versions 0.27.11 through 0.27.13. The vulnerability is exploitable by any client with network access to the gateway port, requiring no valid credentials or elevated privileges to retrieve the telemetry payload. Risk mitigation necessitates an immediate upgrade to version 0.27.14 or higher to enforce proper access control.",
  "technicalDetails": "The vulnerability originates from a regression in gateway/main.go introduced in version 0.27.11. In the OpenFaaS architecture, the gateway routes administrative requests through middleware decorators to ensure security policy enforcement. Specifically, administrative routes under the /system/* namespace are designed to be wrapped by the auth.DecorateWithBasicAuth function when the system is configured for basic authentication.\nThe root cause is the omission of the TelemetryHandler from the decoration block. During the implementation of the /system/telemetry route, the developer failed to register this handler within the scoped block protected by the authentication decorator. Consequently, when a request is made to GET /system/telemetry, the gateway bypasses the credential verification logic entirely.\nThe attack flow is straightforward: An attacker identifies the target OpenFaaS gateway port accessible over the network. By crafting a standard HTTP GET request directed at /system/telemetry, the attacker forces the gateway to process the request through the forwarding proxy without validating the request header for Authorization credentials. The proxy then retrieves the telemetry data directly from the configured provider—such as faasd or faas-netes—and returns the response body to the attacker.\nThe sensitivity of the exposed information is determined by the backend provider: for faasd, this includes underlying host resource metrics and function invocation data; for faas-netes, this includes Kubernetes-level cluster state information, pod metrics, and metadata regarding deployed functions. This provides an attacker with reconnaissance data that can be used to map the internal state of the serverless environment, identify performance bottlenecks, or locate potential targets for further exploitation within the container orchestration layer.\nThe vulnerability affects OpenFaaS gateway versions 0.27.11, 0.27.12, and 0.27.13. Version 0.27.14 resolves this by explicitly including the TelemetryHandler within the auth.DecorateWithBasicAuth middleware chain, thereby ensuring that all requests to this endpoint are subject to the same authentication requirements as other administrative /system/ endpoints."
}