CVE-2026-61682: kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
Vulnerability summary
CVE-2026-61682 is a critical (CVSS 9.9) Authentication Bypass by Spoofing vulnerability in kcp-dev kcp. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 32.4% of scored vulnerabilities.
Severe, CVSS 9.9 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 18-09-2026PublishedVulnerability first disclosed.
- 21-09-2026Last modifiedVulnerability information updated.
Description
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · GoEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- NVDNIST9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.38% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
- CWE-302Authentication Bypass by Assumed-Immutable DataThe authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
- CWE-348Use of Less Trusted SourceThe product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard16 products
- kcp-0.29All versions (No fix recorded)
- kcp-0.29-cache-serverAll versions (No fix recorded)
- kcp-0.29-front-proxyAll versions (No fix recorded)
- kcp-0.29-virtual-workspacesAll versions (No fix recorded)
- kcp-0.30All versions (No fix recorded)
Github.com/kcp-dev1 product
- kcp< 0.31.4 | ≥ 0.32.0, < 0.32.2
Kcp-dev1 product
- kcp< 0.31.4 | ≥ 0.32.0, < 0.32.2
3 vendors · 18 products
References
8 links- github.com/kcp-dev/kcpPACKAGE
