Kcp-dev vulnerabilities
We track 3 vulnerabilities in Kcp-dev products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 18, 2026.
Latest Kcp-dev vulnerabilities
- 9.9 Critical severity
kcp: Authentication Bypass by Spoofing
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before
- 9.1 Critical severity
kcp: Authentication Bypass by Assumed-Immutable Data
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows
- 9.6 Critical severity
kcp: Improper Authorization
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target work