Log in Start free

Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M

CVE-2026-61682kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

Critical 9.9

In plain English

A critical-severity authentication bypass by spoofing in kcp from kcp-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.4%top 67.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/kcp-dev/kcp0.31.4GHSA-c8w2-fgvx-vhv4
Gogithub.com/kcp-dev/kcp0.32.2GHSA-c8w2-fgvx-vhv4
Gogithub.com/kcp-dev/kcp0.31.4, 0.32.2GO-2026-6517

Affected products (as reported)

VendorProductVersions
kcp-dev kcp < 0.31.4>= 0.32.0, < 0.32.2

Weakness: CWE-290, CWE-302, CWE-348 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References