CVE-2026-81664

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basicauth is enabled, wraps each administrative /system/ handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added i...

CVE-2026-81664

OpenFaaS gateway versions 0.27.11 through 0.27.13 contain a missing authentication flaw on the GET /system/telemetry route. The TelemetryHandler was omitted from the auth.DecorateWithBasicAuth wrap block, so when basic_auth is enabled the route still forwards requests to the provider without a cr...

EUVD-2026-67033

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basicauth is enabled, wraps each administrative /system/ handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added i...