PkgSeer

Vulnerability GO-2026-6517

Unknown

3 hours ago

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp

v0.2.0 - v0.31.3

Summary

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp

Details

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

v0.2.0 - v0.31.3 and v0.32.0 - v0.32.1 GHSA-c8w2-fgvx-vhv4

kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp

v0.2.0 - v0.29.2 GO-2026-5088

kcp's cache server is accessible without authentication or authorization checks

v0.2.0 - v0.29.2 and v0.30.0 - v0.30.2 GHSA-3j3q-wp9x-585p

kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp

v0.2.0 - v0.28.2 GO-2025-3985

kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace

v0.2.0 - v0.28.2 GHSA-q6hv-wcjr-wp8h

View all vulnerabilities for these packages

Impacted packages

github.com/kcp-dev/kcp

Timeline

Published

3 hours ago

Last Modified

2 hours ago