Is CVE-2026-81664 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81664 being exploited in the wild.

How severe is CVE-2026-81664?

Medium severity, with a CVSS score of 5.3, published 27 August 2026.

Which products and versions are affected?

OpenFaaS gateway 0.27.11 through 0.27.13.

Is there a fix for CVE-2026-81664?

A patch was published on 0.27.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81664 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-81664?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81664: OpenFaaS gateway missing authentication on /system/telemetry endpoint

CVE-2026-81664 · Severity: medium · CVSS 5.3 · Published 2026-08-27

OpenFaaS is a serverless computing platform used to deploy and manage functions. The gateway component has an oversight where the /system/telemetry endpoint is not protected by basic authentication, even when authentication is enabled, allowing anyone with network access to read sensitive telemetry data about resource usage, function invocations, and cluster state that should only be available to administrators.

Quick answers

Is CVE-2026-81664 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81664 being exploited in the wild.
How severe is CVE-2026-81664?: Medium severity, with a CVSS score of 5.3, published 27 August 2026.
Which products and versions are affected?: OpenFaaS gateway 0.27.11 through 0.27.13.
Is there a fix for CVE-2026-81664?: A patch was published on 0.27.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81664 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-81664?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authentication control (CWE-306) in the OpenFaaS gateway. The TelemetryHandler, which forwards requests to /system/telemetry to the backend provider (faasd or faas-netes), was omitted from the BasicAuth decoration block in gateway/main.go from versions 0.27.11 through 0.27.14. While all other administrative /system/* handlers are wrapped with auth.DecorateWithBasicAuth when basic_auth is enabled, TelemetryHandler is registered without this protection, allowing unauthenticated requests over the network to reach the endpoint. An attacker can retrieve provider telemetry metrics (resource utilization, invocation counts for faasd; pod/cluster state for faas-netes) without credentials. The issue was patched in version 0.27.14.

Affected products

OpenFaaS gateway 0.27.11 through 0.27.13

Timeline

2026-08-27: disclosed
0.27.14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.