Authentication bypass by spoofing in kcp-dev kcp
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290.
Summary
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kcp-dev | kcp | before 0.31.4; 0.32.0 to before 0.32.2 | 0.31.4, 0.32.2 | Patch available | CNA |
| — | github.com/kcp-dev/kcp (Go) | before 0.31.4 | 0.31.4 | Patch available | GHSA-c8w2-fgvx-vhv4 |
| — | github.com/kcp-dev/kcp (Go) | 0.32.0 to before 0.32.2 | 0.32.2 | Patch available | GHSA-c8w2-fgvx-vhv4 |
- kcp Vendorkcp-dev Affected before 0.31.4; 0.32.0 to before 0.32.2 Fixed in 0.31.4, 0.32.2 Patch available CNA
- github.com/kcp-dev/kcp (Go) Vendor— Affected before 0.31.4 Fixed in 0.31.4 Patch available GHSA-c8w2-fgvx-vhv4
- github.com/kcp-dev/kcp (Go) Vendor— Affected 0.32.0 to before 0.32.2 Fixed in 0.32.2 Patch available GHSA-c8w2-fgvx-vhv4
Remediation
- Fix · CNA kcp (kcp-dev) Fixed in 0.31.4, 0.32.2
- Fix · GHSA-c8w2-fgvx-vhv4 github.com/kcp-dev/kcp (Go) Fixed in 0.31.4 Advisory →
- Fix · GHSA-c8w2-fgvx-vhv4 github.com/kcp-dev/kcp (Go) Fixed in 0.32.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-61682
- 2026-10-03 Alias added: GHSA-c8w2-fgvx-vhv4
References
Other 6
- https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4
- https://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca
- https://github.com/kcp-dev/kcp/commit/f913ee890fb2fd9fa78e50c43474b078bfb6aeff
- https://github.com/kcp-dev/kcp/releases/tag/v0.31.4
- https://github.com/kcp-dev/kcp/releases/tag/v0.32.2
- https://github.com/kcp-dev/kcp
More kcp-dev vulnerabilities
- TI-2025-21304 kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace CVSS 3.1CRITICAL 9.6
Sources
- CVE-2026-61682 · CVE Program
- CVE-2026-61682 · NVD
- FIRST EPSS
- GHSA-c8w2-fgvx-vhv4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences