Executive brief
OpenFaaS is a serverless computing platform used to deploy and manage functions. The gateway component has an oversight where the /system/telemetry endpoint is not protected by basic authentication, even when authentication is enabled, allowing anyone with network access to read sensitive telemetry data about resource usage, function invocations, and cluster state that should only be available to administrators.
Technical details
The vulnerability is a missing authentication control (CWE-306) in the OpenFaaS gateway. The TelemetryHandler, which forwards requests to /system/telemetry to the backend provider (faasd or faas-netes), was omitted from the BasicAuth decoration block in gateway/main.go from versions 0.27.11 through 0.27.14. While all other administrative /system/* handlers are wrapped with auth.DecorateWithBasicAuth when basic_auth is enabled, TelemetryHandler is registered without this protection, allowing unauthenticated requests over the network to reach the endpoint. An attacker can retrieve provider telemetry metrics (resource utilization, invocation counts for faasd; pod/cluster state for faas-netes) without credentials. The issue was patched in version 0.27.14.
Affected products
- OpenFaaS gateway 0.27.11 through 0.27.13
Timeline
- 2026-08-27: disclosed
- 0.27.14: patched