VulnSocial

CVE-2026-61682Disclosure

LOWCVSS 9.9 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-290CWE-302CWE-348

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-19: 1Technical Details · 2026-09-19: 109-19
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Ryan Merck@rmerck
    Disclosure

    Stock kube patching will miss this entirely. kcp's front-proxy let authenticated tenants inject X-Remote-Group and stamp system:masters across workspaces. CVE-2026-61682 is a full isolation break hiding behind request-header auth. https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4

    Post summary

    The tweet discloses CVE-2026-61682 as an isolation break in kcp's front-proxy that lets authenticated tenants spoof X-Remote-Group and gain system:masters across workspaces. It provides technical vulnerability details but no explicit PoC, exploit tool, active exploitation report, or named remediation.

    0001053
    46 followersView on X

Explore more

Back to dashboard