openfaas vulnerabilities

Products

• faas 1

Latest openfaas CVEs

Newest publication first

1. CVE-2026-81664 OpenFaaS Gateway 0.27.11 through 0.27.13 Missing Authentication on the /system/telemetry Route

   Published 2026-08-27

   Medium·CVSS 6.9 EPSS 0.37%

   The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.2...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.