{"id":"EUVD-2026-83043","enisaUuid":"cdde780a-624f-320a-8c77-137fdb9db18a","description":"kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.","datePublished":"Sep 18, 2026, 4:11:46 PM","dateUpdated":"Sep 21, 2026, 8:50:17 PM","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4\nhttps://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca\nhttps://github.com/kcp-dev/kcp/commit/f913ee890fb2fd9fa78e50c43474b078bfb6aeff\nhttps://github.com/kcp-dev/kcp/releases/tag/v0.31.4\nhttps://github.com/kcp-dev/kcp/releases/tag/v0.32.2\n","aliases":"CVE-2026-61682\nGHSA-c8w2-fgvx-vhv4\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"2f22e167-a81a-32f8-bcb1-883cda2be677","product":{"name":"kcp","vendor":{"name":"kcp-dev"}},"product_version":"0.32.0, \u003c 0.32.2"},{"id":"8ca45c76-b7df-3046-b064-1d600c694ba4","product":{"name":"kcp","vendor":{"name":"kcp-dev"}},"product_version":"\u003c 0.31.4"}],"enisaIdVendor":[{"id":"408356bc-2c2f-387e-b763-8abaf4b60095","vendor":{"name":"kcp-dev"}}],"enisaIdVulnerability":[{"id":"04935dee-15a5-3c19-8d4e-1a792ac6850e","vulnerability":{"id":"CVE-2026-61682","description":"kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.","datePublished":"Sep 18, 2026, 4:11:46 PM","dateUpdated":"Sep 21, 2026, 8:50:17 PM","status":"PUBLISHED","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4\nhttps://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca\nhttps://github.com/kcp-dev/kcp/commit/f913ee890fb2fd9fa78e50c43474b078bfb6aeff\nhttps://github.com/kcp-dev/kcp/releases/tag/v0.31.4\nhttps://github.com/kcp-dev/kcp/releases/tag/v0.32.2\n","enisa_id":"EUVD-2026-83043\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Nov 9, 2026, 3:07:42 PM","vulnerabilityProduct":[{"id":"169bea09-7ead-3cea-9f16-eacfd5cf6626","product":{"name":"kcp","vendor":{"name":"kcp-dev"}},"product_version":"\u003c 0.31.4"},{"id":"97c0efb4-f6cc-372c-a4d1-c72496dc6b45","product":{"name":"kcp","vendor":{"name":"kcp-dev"}},"product_version":"0.32.0, \u003c 0.32.2"}],"vulnerabilityVendor":[{"id":"4fd44d66-441a-3b01-9792-bf843e735b76","vendor":{"name":"kcp-dev"}}]}},{"id":"77d74b4e-9f23-3ba8-906d-f0ddb6b26692","vulnerability":{"id":"GHSA-c8w2-fgvx-vhv4","description":"kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace","datePublished":"Sep 18, 2026, 5:15:49 PM","dateUpdated":"Sep 18, 2026, 5:15:49 PM","baseScore":0.0,"references":"https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4\nhttps://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca\nhttps://github.com/kcp-dev/kcp\nhttps://github.com/kcp-dev/kcp/releases/tag/v0.31.4\nhttps://github.com/kcp-dev/kcp/releases/tag/v0.32.2\n","enisa_id":"EUVD-2026-83043\n","aliases":"CVE-2026-61682\nGHSA-c8w2-fgvx-vhv4\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:48 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}