github.com/kcp-dev/kcp
Kubernetes-like control planes for form-factors and use-cases beyond Kubernetes and container workloads.
View on Github
Activity
- Latest release
- 23h ago
- Total releases
- 61
- Cadence
- ~11 days
- Last 12 months
- 27
Reach
- Stars
- 2.8k
Details
- First release
- Mar 15, 2022
| Version | Released | |
|---|---|---|
v0.33.3
patch
|
v0.33.3
patch
Dependencies (46)
+ 38 more |
|
v0.33.2
patch
|
v0.33.2
patch
Dependencies (46)
+ 38 more |
|
v0.32.5
patch
|
v0.32.5
patch
Dependencies (46)
+ 38 more |
|
v0.33.1
patch
|
v0.33.1
patch
Dependencies (46)
+ 38 more |
|
v0.32.4
patch
|
v0.32.4
patch
Dependencies (46)
+ 38 more |
|
v0.33.0
minor
|
v0.33.0
minor
Dependencies (46)
+ 38 more |
|
v0.31.6
patch
|
v0.31.6
patch
Dependencies (43)
+ 35 more |
|
v0.32.3
patch
|
v0.32.3
patch
Dependencies (46)
+ 38 more |
|
v0.31.5
patch
|
v0.31.5
patch
Dependencies (46)
+ 38 more |
|
v0.32.2
patch
|
v0.32.2
patch
Dependencies (46)
+ 38 more |
|
v0.31.4
patch
|
v0.31.4
patch
Dependencies (43)
+ 35 more |
|
v0.31.3
patch
1 CVE
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev |
v0.31.3
patch
Dependencies (43)
+ 35 more |
|
v0.32.1
patch
1 CVE
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev |
v0.32.1
patch
Dependencies (46)
+ 38 more |
|
v0.32.0
minor
1 CVE
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev |
v0.32.0
minor
Dependencies (46)
+ 38 more |
|
v0.31.2
patch
1 CVE
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev |
v0.31.2
patch
Dependencies (43)
+ 35 more |
|
v0.31.1
patch
1 CVE
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev |
v0.31.1
patch
Dependencies (43)
+ 35 more |
|
v0.31.0
minor
1 CVE
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev |
v0.31.0
minor
Dependencies (43)
+ 35 more |
|
v0.29.3
patch
1 CVE
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev |
v0.29.3
patch
Dependencies (39)
+ 31 more |
|
v0.30.3
patch
1 CVE
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev |
v0.30.3
patch
Dependencies (39)
+ 31 more |
|
v0.29.2
patch
2 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev |
v0.29.2
patch
Dependencies (39)
+ 31 more |
|
v0.30.2
patch
2 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev |
v0.30.2
patch
Dependencies (39)
+ 31 more |
|
v0.29.1
patch
2 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev |
v0.29.1
patch
Dependencies (39)
+ 31 more |
|
v0.30.1
patch
2 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev |
v0.30.1
patch
Dependencies (39)
+ 31 more |
|
v0.30.0
minor
2 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev |
v0.30.0
minor
Dependencies (39)
+ 31 more |
|
v0.29.0
minor
2 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev |
v0.29.0
minor
Dependencies (39)
+ 31 more |
|
v0.29.0-rc.1
pre
2 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev |
v0.29.0-rc.1
pre
Dependencies (39)
+ 31 more |
|
v0.29.0-rc.0
pre
2 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev |
v0.29.0-rc.0
pre
Dependencies (39)
+ 31 more |
|
v0.28.3
patch
2 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev |
v0.28.3
patch
Dependencies (37)
+ 29 more |
|
v0.28.2
patch
3 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.28.2
patch
Dependencies (37)
+ 29 more |
|
v0.28.1
patch
3 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.28.1
patch
Dependencies (37)
+ 29 more |
|
v0.28.0
minor
3 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.28.0
minor
Dependencies (37)
+ 29 more |
|
v0.27.1
patch
3 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.27.1
patch
Dependencies (35)
+ 27 more |
|
v0.27.0
minor
3 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.27.0
minor
Dependencies (35)
+ 27 more |
|
v0.26.2
patch
4 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.26.2
patch
Dependencies (39)
+ 31 more |
|
v0.27.0-rc.1
pre
3 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.27.0-rc.1
pre
Dependencies (39)
+ 31 more |
|
v0.27.0-rc.0
pre
3 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.27.0-rc.0
pre
Dependencies (39)
+ 31 more |
|
v0.26.1
minor
4 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.26.1
minor
Dependencies (39)
+ 31 more |
|
v0.26.0-rc1
pre
5 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev
GO-2024-3325
GHSA-c7xh-gjv4-4jgv
Dec 12, 2024
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp Fixed in
0.26.1
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.26.0-rc1
pre
Dependencies (39)
+ 31 more |
|
v0.25.0
minor
5 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev
GO-2024-3325
GHSA-c7xh-gjv4-4jgv
Dec 12, 2024
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp Fixed in
0.26.1
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.25.0
minor
Dependencies (38)
+ 30 more |
|
v0.22.0
minor
5 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev
GO-2024-3325
GHSA-c7xh-gjv4-4jgv
Dec 12, 2024
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp Fixed in
0.26.1
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.22.0
minor
Dependencies (42)
+ 34 more |
|
v0.21.0
minor
5 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev
GO-2024-3325
GHSA-c7xh-gjv4-4jgv
Dec 12, 2024
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp Fixed in
0.26.1
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.21.0
minor
Dependencies (42)
+ 34 more |
|
v0.11.0
minor
5 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev
GO-2024-3325
GHSA-c7xh-gjv4-4jgv
Dec 12, 2024
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp Fixed in
0.26.1
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.11.0
minor
Dependencies (48)
+ 40 more |
|
v0.11.0-alpha.1
pre
5 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev
GO-2024-3325
GHSA-c7xh-gjv4-4jgv
Dec 12, 2024
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp Fixed in
0.26.1
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.11.0-alpha.1
pre
Dependencies (47)
+ 39 more |
|
v0.11.0-alpha.0
pre
5 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev
GO-2024-3325
GHSA-c7xh-gjv4-4jgv
Dec 12, 2024
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp Fixed in
0.26.1
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.11.0-alpha.0
pre
Dependencies (47)
+ 39 more |
|
v0.9.1
patch
5 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev
GO-2024-3325
GHSA-c7xh-gjv4-4jgv
Dec 12, 2024
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp Fixed in
0.26.1
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.9.1
patch
Dependencies (43)
+ 35 more |
|
v0.9.0
minor
5 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev
GO-2024-3325
GHSA-c7xh-gjv4-4jgv
Dec 12, 2024
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp Fixed in
0.26.1
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.9.0
minor
Dependencies (43)
+ 35 more |
|
v0.8.2
minor
5 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev
GO-2024-3325
GHSA-c7xh-gjv4-4jgv
Dec 12, 2024
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp Fixed in
0.26.1
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.8.2
minor
Dependencies (43)
+ 35 more |
|
v0.7.10
patch
5 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev
GO-2024-3325
GHSA-c7xh-gjv4-4jgv
Dec 12, 2024
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp Fixed in
0.26.1
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.7.10
patch
Dependencies (43)
+ 35 more |
|
v0.7.9
patch
5 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev
GO-2024-3325
GHSA-c7xh-gjv4-4jgv
Dec 12, 2024
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp Fixed in
0.26.1
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.7.9
patch
Dependencies (43)
+ 35 more |
|
v0.7.8
patch
5 CVEs
CVE-2026-61682
GO-2026-6517
GHSA-c8w2-fgvx-vhv4
Sep 28, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp Fixed in
0.31.4
0.32.2
References Updated Sep 28, 2026 · Source: OSV.dev
CVE-2026-39429
GO-2026-5088
GHSA-3j3q-wp9x-585p
Jun 25, 2026
kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp Fixed in
0.29.3
0.30.3
References Updated Jul 16, 2026 · Source: OSV.dev
GO-2025-3985
GHSA-q6hv-wcjr-wp8h
Oct 23, 2025
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.28.3
References Updated Mar 03, 2026 · Source: OSV.dev
CVE-2025-29922
GO-2025-3538
GHSA-w2rr-38wv-8rrp
Mar 25, 2025
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp Fixed in
0.26.3
References Updated Mar 03, 2026 · Source: OSV.dev
GO-2024-3325
GHSA-c7xh-gjv4-4jgv
Dec 12, 2024
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp Fixed in
0.26.1
References Updated Mar 03, 2026 · Source: OSV.dev |
v0.7.8
patch
Dependencies (43)
+ 35 more |