GitHub Advisoryadvisory · Go

GHSA-prxj-3gcv-cqrh Tesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials

MEDIUM Published 2026-04-01 Modified 2026-04-01 Official page ↗
Ecosystem
Go
Packages
github.com/teslamotors/fleet-telemetry
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-295
Reviewed
2026-04-01

Affected packages

• Go github.com/teslamotors/fleet-telemetry: < 0.9.0 → fixed in 0.9.0

Description

Summary A vulnerability in vehicle authentication allows threat actor with valid client credentials (i.e., a private key and certificate from a rooted infotainment system) to impersonate arbitrary VINs when authenticating to the telemetry server. Impact The attacker would be able to submit falsified telemetry records for arbitrary VINs.

Related

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References