Intel

CVE-2026-61682

github.com/kcp-dev/kcp: Authentication Bypass by Spoofing (CVE-2026-61682)

criticalEPSS 0.4%

Description

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.

Source: OSV (Open Source Vulnerabilities)NVD (NIST)cvelistv5GitHub Security Advisories

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

gogithub.com/kcp-dev/kcp
0.32.0

Metrics

XIEM Effective CVSS
9.9
Source: cna-v3
EPSS percentile
30.3 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
critical
Priority score
86.86
Exploit maturity
no public PoC known
CVSS v3
9.9
EPSS score
0.4 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-09-28 16:43 UTC
CWE
CWE-290, CWE-302, CWE-348

Weakness classes (CWE)

  • CWE-290Base

    Authentication Bypass by Spoofing

    This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

    cwe.mitre.org →

  • CWE-302Base

    Authentication Bypass by Assumed-Immutable Data

    The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

    cwe.mitre.org →

  • CWE-348Base

    Use of Less Trusted Source

    The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-09-21 21:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-61682","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
  2. New CVE Received2026-09-18 16:17 UTC· security-advisories@github.com
    • Description: kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.
    • CVSS V3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    • CWE: CWE-290
    • CWE: CWE-302