PT-2026-32137 · Go · Github.Com/Teslamotors/Fleet-Telemetry

Published 2026-04-01 · Updated 2026-04-01

OSV

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

A vulnerability in vehicle authentication allows threat actor with valid client credentials (i.e., a private key and certificate from a rooted infotainment system) to impersonate arbitrary VINs when authenticating to the telemetry server.

Impact

The attacker would be able to submit falsified telemetry records for arbitrary VINs.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

GHSA-PRXJ-3GCV-CQRH

Affected Products

Github.Com/Teslamotors/Fleet-Telemetry

References · 4

• https://osv.dev/vulnerability/GHSA-prxj-3gcv-cqrh · Vendor Advisory
• https://github.com/teslamotors/fleet-telemetry · Note
• https://github.com/teslamotors/fleet-telemetry/commit/d5ca0dab55812029fd38eb77f079f74ce4f47286 · Note
• https://github.com/teslamotors/fleet-telemetry/security/advisories/GHSA-prxj-3gcv-cqrh · Note