---
id: "CVE-2026-65960"
page: "https://infrastack.ai/live/CVE-2026-65960"
kind: "vulnerability"
aliases: ["CVE-2026-65960"]
title: "Tetragon: unauthenticated gRPC listener lets same-node pods escalate privileges"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ebpf", "helm", "kubernetes", "runtime", "tetragon"]
not_affected_if: ["no-hostnetwork-pods", "no-tcp-listener", "version-1.7.0-or-later"]
published_at: "2026-11-06T20:17:24+00:00"
first_seen_at: "2026-11-06T20:44:00+00:00"
updated_at: "2026-11-06T20:44:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65960", "first_seen_at": "2026-11-06T20:44:00+00:00"}]
exploit_sources: []
---

# Tetragon: unauthenticated gRPC listener lets same-node pods escalate privileges

Link for people: https://infrastack.ai/live/CVE-2026-65960 (this .md is for agents)

Tetragon versions before 1.7.0 ship a Helm default that exposes its privileged gRPC API on an unauthenticated TCP listener at localhost:54321. A attacker running or controlling a hostNetwork pod on the same node can call that API to change tracing policies and debug settings, which can lead to privilege escalation or container escape.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Tetragon version with `helm list -A` and the chart values for the gRPC endpoint setting
- Look for a TCP listener on port `54321` on Kubernetes nodes running Tetragon
- Check whether any `hostNetwork: true` pods run on the same nodes as Tetragon

## Fix

- Tetragon: move to `1.7.0` or later, which changes the default endpoint to a Unix-domain socket

## Timeline

- 2026-11-06T20:44:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65960

## Documents

- [advisory] Vendor advisory: github.com https://github.com/cilium/tetragon/security/advisories/GHSA-6qqg-3qf7-p3v5
- [fix] Patch: github.com https://github.com/cilium/tetragon/commit/8e89933d3526f37c04f7523013ff32f8b1c6f62a
- [fix] Patch: github.com https://github.com/cilium/tetragon/commit/fe46101770b960ebbf39fe9749bb20d49cf178b2
- [fix] Release notes: github.com https://github.com/cilium/tetragon/releases/tag/v1.7.0

## From the sources

Tetragon is an eBPF-based security observability and runtime enforcement project. Versions before 1.7.0 can use a Helm default that exposes the privileged Tetragon gRPC API through an unauthenticated TCP listener on localhost:54321. An attacker who can run or compromise same-node hostNetwork pods can reach the listener and invoke privileged methods without authentication. These methods can add, delete, or reconfigure tracing policies and change debug settings, potentially resulting in privilege escalation or container escape. Version 1.7.0 changes the default endpoint to a Unix-domain socket. Deployments that do not expose an unauthenticated TCP listener are not affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_