Vulnerability Description
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca
- https://github.com/kcp-dev/kcp/commit/f913ee890fb2fd9fa78e50c43474b078bfb6aeff
- https://github.com/kcp-dev/kcp/releases/tag/v0.31.4
- https://github.com/kcp-dev/kcp/releases/tag/v0.32.2
- https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4
FAQ
What is CVE-2026-61682?
CVE-2026-61682 is a vulnerability with a CVSS score of 9.9 (CRITICAL). kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, ...
How severe is CVE-2026-61682?
CVE-2026-61682 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-61682?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.