---
id: CVE-2026-61682
title: >-
  kcp is a Kubernetes-like control plane for form-factors and use-cases beyond
  Kubernetes and container workloads
summary: >-
  kcp is a Kubernetes-like control plane for form-factors and use-cases beyond
  Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp
  front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or
  X-Remote-Extra-* i…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-290
  - CWE-302
  - CWE-348
vendor: kcp-dev
product: kcp
affected:
  - kcp < 0.31.4
  - 'kcp >= 0.32.0, < 0.32.2'
patched:
  - github.com/kcp-dev/kcp 0.31.4
  - github.com/kcp-dev/kcp 0.32.2
published: '2026-09-18'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:25:27.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61682'
references:
  - url: >-
      https://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca
    label: security-advisories@github.com
  - url: >-
      https://github.com/kcp-dev/kcp/commit/f913ee890fb2fd9fa78e50c43474b078bfb6aeff
    label: security-advisories@github.com
  - url: 'https://github.com/kcp-dev/kcp/releases/tag/v0.31.4'
    label: security-advisories@github.com
  - url: 'https://github.com/kcp-dev/kcp/releases/tag/v0.32.2'
    label: security-advisories@github.com
  - url: 'https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-c8w2-fgvx-vhv4'
  - url: 'https://github.com/kcp-dev/kcp'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
  - osv
epss: 0.00384
epssPercentile: 0.29588
aliases:
  - GHSA-c8w2-fgvx-vhv4
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T19:24:33.782681Z'
ingestedAt: '2026-09-18T16:45:41.387Z'
---

## Overview

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61682)

Affected packages:

- `github.com/kcp-dev/kcp < 0.31.4`
- `github.com/kcp-dev/kcp >= 0.32.0, < 0.32.2`

Patched in:

- `github.com/kcp-dev/kcp 0.31.4`
- `github.com/kcp-dev/kcp 0.32.2`

Source: https://github.com/advisories/GHSA-c8w2-fgvx-vhv4