Skip to content
CVE IDCVE-2026-61682GitHub advisory IDGHSA-c8w2-fgvx-vhv4

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

CVE-2026-61682 (GitHub advisory GHSA-c8w2-fgvx-vhv4) is a critical-severity vulnerability with a CVSS 3.1 base score of 9.9, classed as Authentication Bypass by Spoofing (CWE-290), in github.com/kcp-dev/kcp (Go). Affected versions: < 0.31.4; >= 0.32.0, < 0.32.2. It is fixed in 0.31.4 or 0.32.2, depending on the release line.

Critical9.9Fix availableGitHub reviewed

Published 18 Sept 2026Updated 18 Sept 2026

9.9CriticalCVSS 3.1
CVE ID
CVE-2026-61682
GHSA ID
GHSA-c8w2-fgvx-vhv4
EPSS
0.28%higher than 20% of CVEs
Weaknesses (CWE)
  • CWE-290Authentication Bypass by Spoofing
  • CWE-302Authentication Bypass by Assumed-Immutable Data
  • CWE-348Use of Less Trusted Source
KEV status
Not in KEV
Published
18 Sept 2026
Updated
18 Sept 2026
Ecosystem
  • Go
Assigned by (CNA)
GitHub_M

Summary

Source: OSV (GitHub advisory)

The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra-* headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to escalate to cluster administrator (system:masters) and read, write, or delete resources in any workspace on the shard. This is a complete multi-tenant isolation and authorization bypass.

Impact

In a sharded kcp deployment, external clients reach shards through the front-proxy, which authenticates the client and then forwards the resulting identity to the shard using Kubernetes request-header authentication (X-Remote-User / X-Remote-Group / X-Remote-Extra-*). The shard trusts these headers because they arrive over the front-proxy's mutually-authenticated connection.

Because the front-proxy appended its identity headers instead of replacing them — and never removed any copies the client sent — an authenticated attacker could smuggle forged identity headers through to the shard. With this, an attacker holding any ordinary credential (client certificate, OIDC token, or service-account token) and no special privileges could:

  • assert X-Remote-Group: system:masters and act as cluster super-user, bypassing the entire kcp authorizer chain in every workspace on the shard;
  • forge authorization.kcp.io/warrant to assume an arbitrary user/group identity via kcp's delegated-identity mechanism;
  • forge authentication.kcp.io/scopes to escape the cluster-scoping that confines service-account and impersonated identities to their origin workspace;
  • satisfy per-workspace required-group gating by injecting the required group.

The result is arbitrary read/write/delete access to any tenant's resources, secrets, RBAC, APIExports/APIBindings, and LogicalClusters — a cross-workspace access break and authorizer bypass across the proxy's trust boundary.

Patches

Fixed in v0.31.4, 0.32.2. The front-proxy and the shard's in-process local-proxy now unconditionally remove any inbound X-Remote-* identity headers before stamping the authenticated identity, so no client-supplied value can be forwarded to a shard.

Operators should upgrade to a patched release. No configuration changes are required after upgrading.

Workarounds

There is no complete workaround other than upgrading. Deployments that terminate client connections at an external proxy capable of stripping X-Remote-User, X-Remote-Group, and all X-Remote-Extra-* headers from inbound requests before they reach the kcp front-proxy can mitigate exposure in the interim.

Credit to 5ud0er / Tarmo Technologies.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Critical9.9Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
Low
User Interaction UI
None
Scope S
Changed
Confidentiality C
High
Integrity I
High
Availability A
High

Affected packages

Source: OSV (GitHub advisory)

  • github.com/kcp-dev/kcp
    Go
    pkg:golang/github.com/kcp-dev/kcp
    Affected versions
    < 0.31.4
    >= 0.32.0, < 0.32.2
    Fixed in
    0.31.4
    0.32.2

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 0.31.4 or 0.32.2, depending on your release line.

Patch commits

  • 7437cdcPatch commitgithub.com/kcp-dev/kcp

    Merge commit from fork

    +36 −8 across 4 files

    • pkg/proxy/authheaders/authheaders.go+14 −7
    • pkg/proxy/proxy.go+2 −0
    • pkg/proxy/proxy_test.go+18 −1
    • pkg/server/localproxy.go+2 −0
  • f913ee8Patch commitgithub.com/kcp-dev/kcp

    Merge commit from fork

    +36 −8 across 4 files

    • pkg/proxy/authheaders/authheaders.go+14 −7
    • pkg/proxy/proxy.go+2 −0
    • pkg/proxy/proxy_test.go+18 −1
    • pkg/server/localproxy.go+2 −0

Vulnerability intelligence

References

Credits

Questions about CVE-2026-61682

What is the GHSA ID for CVE-2026-61682?
GitHub tracks CVE-2026-61682 as GHSA-c8w2-fgvx-vhv4.
What is the CVSS score of CVE-2026-61682?
CVE-2026-61682 has a CVSS 3.1 base score of 9.9 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Which versions are affected by CVE-2026-61682?
github.com/kcp-dev/kcp (Go): < 0.31.4; >= 0.32.0, < 0.32.2.
How do I fix CVE-2026-61682?
Upgrade to 0.31.4 or 0.32.2, depending on the release line. The fix is in commits 7437cdc and f913ee8.
What is the Package URL (PURL) for CVE-2026-61682?
The affected package's PURL is pkg:golang/github.com/kcp-dev/kcp.
Is CVE-2026-61682 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-61682. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 20% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 2 days ago (13 Oct 2026, 13:27 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.