Skip to content
OpenAdvisories

Package · Go

github.com/kcp-dev/kcp

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-61682

    kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

    kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before…

    kcp-dev kcp github.com/kcp-dev/kcp Go
  • Critical 9.6
    CVE-2025-29922

    kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

    kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target wor…

    kcp-dev kcp github.com/kcp-dev/kcp Go