CVE-2026-61682 Details
Description
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.
A vulnerability exists in KCP (Kubernetes-like control plane) front-proxy versions prior to 0.31.4 and 0.32.2. The issue arises because the front-proxy fails to remove inbound X-Remote-User, X-Remote-Group, and X-Remote-Extra-* identity headers before forwarding requests to shards. This oversight allows any authenticated tenant to inject specific group headers, which are then trusted as authenticated identity assertions by the shard. As a result, this vulnerability enables cross-workspace impersonation, authorization bypass, and unauthorized access to resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters.
Users should upgrade to KCP versions 0.31.4 or 0.32.2, where this vulnerability has been fixed. After upgrading, no additional configuration changes are required.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca | [email protected] | Source CodeVendor |
| https://github.com/kcp-dev/kcp/commit/f913ee890fb2fd9fa78e50c43474b078bfb6aeff | [email protected] | Source CodeVendor |
| https://github.com/kcp-dev/kcp/releases/tag/v0.31.4 | [email protected] | Release NotesVendor |
| https://github.com/kcp-dev/kcp/releases/tag/v0.32.2 | [email protected] | Release NotesVendor |
| https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
| CWE-302 | Authentication Bypass by Assumed-Immutable Data | [email protected] |
| CWE-348 | Use of Less Trusted Source | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kcp-dev kcp | >= 0.32.0, < 0.32.2 (semver) < 0.31.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |