CVE-2026-81664: openfaas faas advisory

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added it. On an affected gateway the route therefore reaches the forwarding proxy with no credential check and returns whatever the configured provider serves for /system/telemetry, so any client that can reach the gateway port can read the provider’s telemetry regardless of the basic_auth setting. The exposed content depends on the provider, and covers resource and invocation metrics for faasd and pod or cluster state for faas-netes.

Description quoted from the CVE record (assigned by VulnCheck, published 2026-08-27).

Weakness: Missing Authentication for Critical Function

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing no privileges and no user interaction. Impact: confidentiality low, integrity none, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: yes. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Exploit Observer found 5 code repositories naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 8 references on Exploit Observer

Live scores

EPSS: 0.004
low predicted chance of attack
VEDAS: 0.989
strong exploit evidence
On CISA KEV: Not listed
Detection rule: Nuclei · Suricata

Who is affected

Product	Affected	Not affected
openfaas faas	from 0.27.11 before 0.27.14	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Fixed versions stated in the CVE record: 0.27.14.

Vendor guidance:

Protect telemetry with BasicAuth (patch)

How to detect it

Nuclei template (active check)

OpenFaaS Gateway - Authentication Bypass on /system/telemetry
The OpenFaaS gateway registered GET /system/telemetry in versions 0.27.11 through 0.27.13 without wrapping it in the basic-auth decorator applied to the other administrative /system/* routes. On a gateway with basic_auth enabled, the telemetry route therefore reaches the forwarding proxy with no credential check and returns the provider’s telemetry to any client. This template confirms the bypass differentially: the auth-protected /system/functions route returns 401 while /system/telemetry returns 200 to the same unauthenticated client, proving telemetry escaped the auth wrapper.

Name and description quoted from the template, written by VEDAS.

The template sends 2 requests (GET /system/functions, GET /system/telemetry); it decides using dsl matchers. Severity in the template: medium. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash

nuclei -u https://your-host -t CVE-2026-81664.yaml

Show the template (44 lines)

yaml

id: CVE-2026-81664

info:
  name: "OpenFaaS Gateway - Authentication Bypass on /system/telemetry"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    The OpenFaaS gateway registered GET /system/telemetry in versions 0.27.11 through 0.27.13 without
    wrapping it in the basic-auth decorator applied to the other administrative /system/* routes. On a
    gateway with basic_auth enabled, the telemetry route therefore reaches the forwarding proxy with no
    credential check and returns the provider's telemetry to any client. This template confirms the
    bypass differentially: the auth-protected /system/functions route returns 401 while /system/telemetry
    returns 200 to the same unauthenticated client, proving telemetry escaped the auth wrapper.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-81664&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=openfaas&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 6.9
    cve-id: CVE-2026-81664
    cwe-id: CWE-306
  metadata:
    verified: false
  tags: cve,cve2026,openfaas,auth-bypass,exposure

http:
  - raw:
      - |
        GET /system/functions HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json
      - |
        GET /system/telemetry HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    req-condition: true
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 401"
          - "status_code_2 == 200"
        condition: and

CVE-2026-81664.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-81664 OpenFaaS Gateway - Unauthenticated Access to /system/telemetry. Add them to your Suricata rule set and reload.

Show the rules

suricata

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-81664 OpenFaaS Gateway - Unauthenticated Access to /system/telemetry"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/system/telemetry"; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2026-81664; reference:url,https://www.exploit.observer/?keyword=CVE-2026-81664&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=openfaas&match=exact; sid:1081804; rev:1;)

CVE-2026-81664.rules on GitHub

References

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.