kcp-dev/kcp Security Advisories | GitStock

critical2026-09-18

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

GHSA-c8w2-fgvx-vhv4 · CVE-2026-61682

high2026-04-08

kcp's cache server is accessible without authentication or authorization checks

GHSA-3j3q-wp9x-585p · CVE-2026-39429

low2025-09-26

kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace

GHSA-q6hv-wcjr-wp8h

critical2025-03-20

kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

GHSA-w2rr-38wv-8rrp · CVE-2025-29922

medium2024-12-11

kcp's impersonation allows access to global administrative groups

GHSA-c7xh-gjv4-4jgv