46 matches found
GO-2026-6610 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-autoscalingplans, dl, cyberark-secrets-provider-for-k8s, kind, nats-server-fips, zabbix-agent2, oras-fips, yunikorn-k8shim-fips, commercial-gitlab-rails-ee, kube-mgmt, k8ssandra-operator, crossplane-provider-aws-ce-fips, kates, helmfile,...
GO-2026-6603 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-kinesis, zabbix-agent2, yunikorn-k8shim-fips, commercial-gitlab-rails-ee, kube-mgmt, kates, jaeger, helmfile, virt-operator-fips, kubernetes, k6, coder, gobgp, openbao-k8s, azuredisk-csi, gobgp-fips, sops-fips, crossplane-function-go-templatin...
GO-2026-6612 vulnerabilities
Vulnerabilities for packages: zabbix-agent2, yunikorn-k8shim-fips, commercial-gitlab-rails-ee, kube-mgmt, jaeger, helmfile, virt-operator-fips, crossplane-provider-gcp-beta-cloudplatform-fips, kubernetes, k6, coder, gobgp, openbao-k8s, azuredisk-csi, gobgp-fips, crossplane-function-go-templating,...
GO-2026-6611 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-kinesis, zabbix-agent2, yunikorn-k8shim-fips, commercial-gitlab-rails-ee, kube-mgmt, kates, jaeger, helmfile, virt-operator-fips, kubernetes, k6, coder, gobgp, openbao-k8s, azuredisk-csi, gobgp-fips, sops-fips, crossplane-function-go-templatin...
CVE-2026-78669 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-kinesis, zabbix-agent2, yunikorn-k8shim-fips, commercial-gitlab-rails-ee, kube-mgmt, kates, jaeger, helmfile, virt-operator-fips, kubernetes, k6, coder, gobgp, openbao-k8s, azuredisk-csi, gobgp-fips, sops-fips, crossplane-function-go-templatin...
GO-2026-6517 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp
kcp front-proxy does not strip inbound X-Remote- identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp...
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra- headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to...
GHSA-C8W2-FGVX-VHV4 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra- headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to...
CVE-2026-61682
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-61682 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
EUVD-2026-83043
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-61682 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-61682 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-61682
kcp is a Kubernetes-like control plane. Prior to 0.31.4 and 0.32.2 , the kcp front-proxy does not strip inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. An authenticated tenant can inject headers such as X-Remote-Group: system:maste...
PT-2026-95474
Name of the Vulnerable Software and Affected Versions kcp versions prior to 0.31.4 kcp versions prior to 0.32.2 Description The kcp front-proxy fails to remove inbound identity headers before forwarding requests to shards. An authenticated tenant can inject forged headers, which the shard trusts ...
CVE-2026-61682: Authentication Bypass by Spoofing
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any...
CVE-2026-73499 vulnerabilities
Vulnerabilities for packages: dapr, rancher-support-bundle-kit, dapr-fips, multicluster-controlplane, kcp, multicluster-controlplane-fips, kcp-fips, milvus, kine...
GO-2026-6114 vulnerabilities
Vulnerabilities for packages: dapr, rancher-support-bundle-kit, dapr-fips, multicluster-controlplane, kcp, multicluster-controlplane-fips, kcp-fips, milvus, kine...