Cross-Workspace Impersonation Vulnerability in kcp Control Plane by kcp-dev
CVE-2026-61682
9.9CRITICAL
What is CVE-2026-61682?
The kcp control plane, designed for diverse form-factors beyond Kubernetes, has a vulnerability where the front-proxy fails to sanitize inbound identity headers, such as X-Remote-User and X-Remote-Group. This oversight allows authenticated tenants to manipulate identity assertions, leading to serious security implications like authorization bypass and unauthorized access to sensitive resources across different workspaces. The vulnerability is resolved in versions 0.31.4 and 0.32.2, which should be deployed immediately to secure environments.
Affected Version(s)
kcp < 0.31.4 < 0.31.4
kcp >= 0.32.0, < 0.32.2 < 0.32.0, 0.32.2