kcp-dev vulnerabilities

3 published CVEs name kcp-dev among the affected products.

Critical 2High 1Medium 0Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2026-61682
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
kcp-dev · kcp
Critical9.9
CVE-2026-39429
kcp's cache server is accessible without authentication or authorization checks
kcp-dev · kcp
High8.2
CVE-2025-29922
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace
kcp-dev · kcp
Critical9.6