48 matches found
GO-2026-6610 vulnerabilities
Vulnerabilities for packages: crossplane-provider-azure-securityinsights, kubescape-server-fips, krakend, qemu-guesthelper, open-cluster-management, argo-events-fips, crossplane-provider-azure-servicenetworking, rancher-webhook, gitness, mongodb-kubernetes-readinessprobe, wal-g, knative-serving,...
GO-2026-6603 vulnerabilities
Vulnerabilities for packages: crossplane-provider-azure-securityinsights, cosmo-router-fips, kubescape-server-fips, krakend, qemu-guesthelper, open-cluster-management, argo-events-fips, kafka-proxy-fips, crossplane-provider-azure-servicenetworking, rancher-webhook, grafana-elasticsearch-datasourc...
GO-2026-6611 vulnerabilities
Vulnerabilities for packages: crossplane-provider-azure-securityinsights, cosmo-router-fips, kubescape-server-fips, krakend, qemu-guesthelper, open-cluster-management, argo-events-fips, kafka-proxy-fips, crossplane-provider-azure-servicenetworking, rancher-webhook, grafana-elasticsearch-datasourc...
GO-2026-6612 vulnerabilities
Vulnerabilities for packages: crossplane-provider-azure-securityinsights, cosmo-router-fips, kubescape-server-fips, krakend, qemu-guesthelper, open-cluster-management, argo-events-fips, kafka-proxy-fips, crossplane-provider-azure-servicenetworking, rancher-webhook, grafana-elasticsearch-datasourc...
CVE-2026-78669 vulnerabilities
Vulnerabilities for packages: crossplane-provider-azure-securityinsights, cosmo-router-fips, kubescape-server-fips, krakend, qemu-guesthelper, open-cluster-management, argo-events-fips, kafka-proxy-fips, crossplane-provider-azure-servicenetworking, rancher-webhook, grafana-elasticsearch-datasourc...
GO-2026-6517 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp
kcp front-proxy does not strip inbound X-Remote- identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp...
GHSA-C8W2-FGVX-VHV4 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra- headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to...
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra- headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to...
CVE-2026-61682
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-61682
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-61682 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-61682 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-61682
kcp is a Kubernetes-like control plane. Prior to 0.31.4 and 0.32.2 , the kcp front-proxy does not strip inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. An authenticated tenant can inject headers such as X-Remote-Group: system:maste...
CVE-2026-61682 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
EUVD-2026-83043
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-61682: Authentication Bypass by Spoofing
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
PT-2026-95474
Name of the Vulnerable Software and Affected Versions kcp versions prior to 0.31.4 kcp versions prior to 0.32.2 Description The kcp front-proxy fails to remove inbound identity headers before forwarding requests to shards. An authenticated tenant can inject forged headers, which the shard trusts ...
GO-2026-6114 vulnerabilities
Vulnerabilities for packages: multicluster-controlplane, multicluster-controlplane-fips, dapr, milvus, kcp-fips, rancher-support-bundle-kit, kcp, dapr-fips, kine...