Tetragon: Unauthenticated Tetragon gRPC admin API accessible from hostNetwork pods
Affects Tetragon Kubernetes Helm deployments that run an unauthenticated TCP gRPC listener. The fix is in Tetragon 1.7.0.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 1.7.0
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Tetragon deployment exposes the gRPC API over an unauthenticated TCP listener Tetragon Kubernetes Helm deployment using an unauthenticated TCP gRPC listener
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 14/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Tetragon, an eBPF-based security observability and runtime enforcement project, can expose its privileged gRPC admin API through an unauthenticated TCP listener. An attacker with local, low-privilege access, such as a process in a hostNetwork pod on the same node, can use that listener to add, delete, or reconfigure tracing policies and change debug settings, potentially escalating privileges or escaping a container.
Read the original description
Tetragon is an eBPF-based security observability and runtime enforcement project. Versions before 1.7.0 can use a Helm default that exposes the privileged Tetragon gRPC API through an unauthenticated TCP listener on localhost:54321. An attacker who can run or compromise same-node hostNetwork pods can reach the listener and invoke privileged methods without authentication. These methods can add, delete, or reconfigure tracing policies and change debug settings, potentially resulting in privilege escalation or container escape. Version 1.7.0 changes the default endpoint to a Unix-domain socket. Deployments that do not expose an unauthenticated TCP listener are not affected.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.8/10CVSS 8.8
- No patch0/5No signal
What would change the score
- Would score about 64 if added to CISA KEV
- Would score about 59 if CISA's SSVC rates exploitation active
- Would score about 24 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Tetragon deployment exposes the gRPC API over an unauthenticated TCP listener Tetragon Kubernetes Helm deployment using an unauthenticated TCP gRPC listenerUpgrade to a fixed version: 1.7.0.
Workaround: Expose the gRPC API over a Unix-domain socket instead of TCP, or disable the gRPC API
Timeline
- CVE published
- First seen by cve.now
Affected versions
- cilium tetragon
fixed in 1.7.0
Evidence 5
- Advisory
- Repository
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-65960
Is CVE-2026-65960 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The Tetragon gRPC admin API can be called without authentication over a TCP listener. Callers can add, delete or reconfigure tracing policies and change debug settings. The advisory says this could lead to container escape or privilege escalation.Source: github.com
Which versions are affected by CVE-2026-65960?
tetragon: before 1.7.0.Source: cve.now feed data
Am I affected, and how do I check?
The issue affects Tetragon Kubernetes Helm deployments that use an unauthenticated TCP gRPC listener, and the title says hostNetwork pods can reach it. Versions before 1.7.0 are in the affected range. Readers can check their Tetragon version and whether the gRPC API is served over a TCP listener.Source: github.com
How do I fix CVE-2026-65960?
Upgrade Tetragon to v1.7.0 or later, which the advisory says contains the patch.Source: github.com
Why do the sources disagree?
The description says the API is unauthenticated, but the CVSS vector lists PR:L, which means some privileges are required to exploit it. The sources therefore differ on whether the attack needs any privileges at all.Source: github.com