Authentication Flaw in Kcp Control Plane Exposing Cache Server
CVE-2026-39429
8.2HIGH
What is CVE-2026-39429?
The Kcp control plane, designed for diverse form-factors beyond container workloads, has a significant vulnerability where its cache server is exposed by the root shard. This exposure occurs due to the absence of proper authentication and authorization mechanisms, allowing unauthorized users to read from and write to the cache server. This vulnerability affects versions prior to 0.30.3 and 0.29.3. To protect your system, it is crucial to upgrade to the latest versions where this flaw has been addressed.
Affected Version(s)
kcp >= 0.30.0, < 0.30.3 < 0.30.0, 0.30.3
kcp < 0.29.3 < 0.29.3