A vulnerability in telepresence versions prior to 2.31.0 allows an attacker to bypass authorization by using a user-controlled session ID. The Traffic Manager Tunnel gRPC streaming endpoint does not verify ownership of the session ID parsed from incoming messages, enabling attackers who obtain a valid session ID to hijack network routing capabilities. This issue is fixed in version 2.31.0.