{"id":"EUVD-2026-83043","revision":"0223605385694d26aee4dcf8aadf4eeb","records":[{"revision":"0223605385694d26aee4dcf8aadf4eeb","observedAt":"2026-11-09T14:10:18.091+00:00","statement":{"source":"euvd","id":"EUVD-2026-83043","aliases":["CVE-2026-61682","GHSA-c8w2-fgvx-vhv4"],"title":"kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* iden…","description":"kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":null}],"references":["https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4","https://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca","https://github.com/kcp-dev/kcp/commit/f913ee890fb2fd9fa78e50c43474b078bfb6aeff","https://github.com/kcp-dev/kcp/releases/tag/v0.31.4","https://github.com/kcp-dev/kcp/releases/tag/v0.32.2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-83043","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 18, 2026, 4:11:46 PM","dateUpdated":"Sep 21, 2026, 8:50:17 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-83043","identifiers":["EUVD-2026-83043","CVE-2026-61682","GHSA-c8w2-fgvx-vhv4"]},"retained":false,"historicalAffected":[]}],"coverage":[]}