CVE-2026-39429: kcp's cache server is accessible without authentication or authorization checks
Vulnerability summary
CVE-2026-39429 is a critical (CVSS 9.1) vulnerability in kcp-dev kcp. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.9% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 08-04-2026PublishedVulnerability first disclosed.
- 10-04-2026Last modifiedVulnerability information updated.
Description
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NDiffers
- OSV · GoEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NDiffers
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
Decrease -0.10 pp
From 0.54% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundKcp
Maturity: poc
Weaknesses
CWE · root cause- CWE-302Authentication Bypass by Assumed-Immutable DataThe authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard20 products
- kcp-0.29< 0.29.3-r2
- kcp-0.29-cache-server< 0.29.3-r2
- kcp-0.29-compat< 0.29.3-r2
- kcp-0.29-front-proxy< 0.29.3-r2
- kcp-0.29-kubectl-plugins< 0.29.3-r2
Github.com/kcp-dev1 product
- kcp< 0.29.3 | ≥ 0.30.0, < 0.30.3
Kcp1 product
- kcp< 0.29.3 | ≥ 0.30.0, < 0.30.3
Kcp-dev1 product
- kcp≥ 0.30.0, < 0.30.3 | < 0.29.3
4 vendors · 23 products
References
6 links- github.com/kcp-dev/kcp/security/advisories/GHSA-3j3q-wp9x-585pX Refsource CONFIRMWEBAdvisoryExploitMitigationVendor Advisory
- github.com/kcp-dev/kcpPACKAGE