Kcp
Monthly
Cross-workspace impersonation and complete authorization bypass in kcp (kcp-dev) before 0.31.4 and 0.32.x before 0.32.2 let any authenticated tenant forge Kubernetes-style identity headers that the shard accepts as trusted authentication assertions. Because the front-proxy and the server localproxy forward inbound X-Remote-User, X-Remote-Group, and X-Remote-Extra-* headers without clearing them, an attacker with valid credentials for any single workspace can supply values such as X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating to read, write, or delete resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters across the installation. Exploitation requires authenticated access (CVSS vector PR:L, AV:N, no UI), yields changed scope per the vendor vector (CVSS 9.9), and no public exploit code or confirmed active exploitation was identified at time of analysis; fixed releases 0.31.4 and 0.32.2 are published.
Cross-workspace impersonation and complete authorization bypass in kcp (kcp-dev) before 0.31.4 and 0.32.x before 0.32.2 let any authenticated tenant forge Kubernetes-style identity headers that the shard accepts as trusted authentication assertions. Because the front-proxy and the server localproxy forward inbound X-Remote-User, X-Remote-Group, and X-Remote-Extra-* headers without clearing them, an attacker with valid credentials for any single workspace can supply values such as X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating to read, write, or delete resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters across the installation. Exploitation requires authenticated access (CVSS vector PR:L, AV:N, no UI), yields changed scope per the vendor vector (CVSS 9.9), and no public exploit code or confirmed active exploitation was identified at time of analysis; fixed releases 0.31.4 and 0.32.2 are published.