Read the docs
TI-2025-21304 Aliases CVE-2025-29922GHSA-w2rr-38wv-8rrp

kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

Priority MEDIUM 43CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By design, this should only be allowed when the workspace owner decides to give access to an API provider by creating an APIBinding. With this vulnerability, it is possible for an attacker to create and delete objects even if none of these requirements are satisfied, i.e. even if there is no APIBinding in that workspace at all or the workspace owner has created an APIBinding, but rejected a permission claim. A fix for this issue has been identified and has been published with kcp 0.26.3 and 0.27.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Fix Fixed kcp (kcp-dev): 0.26.3github.com/kcp-dev/kcp (Go): 0.26.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kcp-devkcpbefore 0.26.30.26.3Patch availableCNA
—github.com/kcp-dev/kcp (Go)before 0.26.30.26.3Patch availableGHSA-w2rr-38wv-8rrp
  • kcp Vendorkcp-dev Affected before 0.26.3 Fixed in 0.26.3 Patch available CNA
  • github.com/kcp-dev/kcp (Go) Vendor— Affected before 0.26.3 Fixed in 0.26.3 Patch available GHSA-w2rr-38wv-8rrp

Remediation

  • Fix · CNA kcp (kcp-dev) Fixed in 0.26.3
  • Fix · GHSA-w2rr-38wv-8rrp github.com/kcp-dev/kcp (Go) Fixed in 0.26.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-29922
  2. 2026-10-03 Alias added: GHSA-w2rr-38wv-8rrp

References

Advisory 1

Other 4

  • TI-2026-44160 Authentication bypass by spoofing in kcp-dev kcp CVSS 3.1CRITICAL 9.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences