GHSA-XG4H-6GFC-H4M8 vulnerabilities

Vulnerabilities for packages: rancher-support-bundle-kit, kine, dapr, multicluster-controlplane, kcp, multicluster-controlplane-fips, milvus, dapr-fips, kcp-fips...

CVE-2026-73499 vulnerabilities

Vulnerabilities for packages: rancher-support-bundle-kit, kine, dapr, multicluster-controlplane, kcp, multicluster-controlplane-fips, milvus, dapr-fips, kcp-fips...

GO-2026-6114 vulnerabilities

Vulnerabilities for packages: rancher-support-bundle-kit, kine, dapr, multicluster-controlplane, kcp, multicluster-controlplane-fips, milvus, dapr-fips, kcp-fips...

GO-2026-5088 vulnerabilities

Vulnerabilities for packages: kcp, kcp-fips...

GO-2026-5736 vulnerabilities

Vulnerabilities for packages: rancher-support-bundle-kit, dapr, multicluster-controlplane, kcp, multicluster-controlplane-fips, juicefs, etcd, milvus, dapr-fips, kcp-fips...

GO-2026-5038 vulnerabilities

Vulnerabilities for packages: hubble-fips, k8s-agents-operator, datadog-agent-fips, docker-fips, crossplane-provider-aws-elasticsearch-fips, kube-logging-logging-operator, vault-fips, longhorn-share-manager, local-path-provisioner, mattermost, docker-machine-driver-harvester,...

GO-2026-5088 kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp

kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp...

CVE-2026-39429 vulnerabilities

Vulnerabilities for packages: kcp, kcp-fips...

GHSA-3J3Q-WP9X-585P vulnerabilities

Vulnerabilities for packages: kcp, kcp-fips...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to missing authentication and authorization checks in the cache server. An attacker can gain unauthorized read and write access by sending requests directly to the exposed service. Remediation Upgrade...

CVE-2026-39429 kcp's cache server is accessible without authentication or authorization checks

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard...

CVE-2026-39429 kcp's cache server is accessible without authentication or authorization checks

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard...

CVE-2026-39429

The CVE-2026-39429 issue in kcp affects the root shard’s cache server, which before versions 0.30.3 and 0.29.3 was exposed with no authentication/authorization. The cache server could be read from and written to by anyone who can reach the root shard, enabling unauthorized access to cached resour...

GO-2025-3985 kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp

kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp...

EUVD-2025-7159

Malicious code in bioql PyPI...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization through the APIExport VirtualWorkspace. An attacker can create and delete objects in arbitrary target workspaces without the necessary permissions by exploiting this vulnerability. Workaround This vulnerability ca...

CVE-2025-29922

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By...

CVE-2025-29922 kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By...

CVE-2025-29922 kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By...

CVE-2025-29922 kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By...