GHSA-C8W2-FGVX-VHV4

Vulnerability from github – Published: 2026-09-18 17:15 – Updated: 2026-09-18 17:15

Summary

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

Details

Summary

The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra-* headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to escalate to cluster administrator (system:masters) and read, write, or delete resources in any workspace on the shard. This is a complete multi-tenant isolation and authorization bypass.

Impact

In a sharded kcp deployment, external clients reach shards through the front-proxy, which authenticates the client and then forwards the resulting identity to the shard using Kubernetes request-header authentication (X-Remote-User / X-Remote-Group / X-Remote-Extra-*). The shard trusts these headers because they arrive over the front-proxy's mutually-authenticated connection.

Because the front-proxy appended its identity headers instead of replacing them — and never removed any copies the client sent — an authenticated attacker could smuggle forged identity headers through to the shard. With this, an attacker holding any ordinary credential (client certificate, OIDC token, or service-account token) and no special privileges could:

assert X-Remote-Group: system:masters and act as cluster super-user, bypassing the entire kcp authorizer chain in every workspace on the shard;
forge authorization.kcp.io/warrant to assume an arbitrary user/group identity via kcp's delegated-identity mechanism;
forge authentication.kcp.io/scopes to escape the cluster-scoping that confines service-account and impersonated identities to their origin workspace;
satisfy per-workspace required-group gating by injecting the required group.

The result is arbitrary read/write/delete access to any tenant's resources, secrets, RBAC, APIExports/APIBindings, and LogicalClusters — a cross-workspace access break and authorizer bypass across the proxy's trust boundary.

Patches

Fixed in v0.31.4, 0.32.2. The front-proxy and the shard's in-process local-proxy now unconditionally remove any inbound X-Remote-* identity headers before stamping the authenticated identity, so no client-supplied value can be forwarded to a shard.

Operators should upgrade to a patched release. No configuration changes are required after upgrading.

Workarounds

There is no complete workaround other than upgrading. Deployments that terminate client connections at an external proxy capable of stripping X-Remote-User, X-Remote-Group, and all X-Remote-Extra-* headers from inbound requests before they reach the kcp front-proxy can mitigate exposure in the interim.

Credit to 5ud0er / Tarmo Technologies.

Severity

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kcp-dev/kcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.31.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kcp-dev/kcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.32.0"
            },
            {
              "fixed": "0.32.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61682"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290",
      "CWE-302",
      "CWE-348"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-18T17:15:49Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "# Summary\n\nThe kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own `X-Remote-Group` and `X-Remote-Extra-*` headers, which the shard trusts as a verified identity assertion \u2014 allowing a low-privilege user to escalate to cluster administrator (`system:masters`) and read, write, or delete resources in any workspace on the shard. This is a complete multi-tenant isolation and authorization bypass.\n\n## Impact \n\nIn a sharded kcp deployment, external clients reach shards through the front-proxy, which authenticates the client and then forwards the resulting identity to the shard using Kubernetes request-header authentication (`X-Remote-User` / `X-Remote-Group` / `X-Remote-Extra-*`). The shard trusts these headers because they arrive over the front-proxy\u0027s mutually-authenticated connection.\n\nBecause the front-proxy appended its identity headers instead of replacing them \u2014 and never removed any copies the client sent \u2014 an authenticated attacker could smuggle forged identity headers through to the shard. With this, an attacker holding any ordinary credential (client certificate, OIDC token, or service-account token) and no special privileges could:\n\n- assert `X-Remote-Group: system:masters` and act as cluster super-user, bypassing the entire kcp authorizer chain in every workspace on the shard;\n- forge `authorization.kcp.io/warrant` to assume an arbitrary user/group identity via kcp\u0027s delegated-identity mechanism;\n- forge `authentication.kcp.io/scopes` to escape the cluster-scoping that confines service-account and impersonated identities to their origin workspace;\n- satisfy per-workspace required-group gating by injecting the required group.\n\nThe result is arbitrary read/write/delete access to any tenant\u0027s resources, secrets, RBAC, APIExports/APIBindings, and LogicalClusters \u2014 a cross-workspace access break and authorizer bypass across the proxy\u0027s trust boundary.\n\n\n# Patches\nFixed in v0.31.4, 0.32.2. The front-proxy and the shard\u0027s in-process local-proxy now unconditionally remove any inbound `X-Remote-*` identity headers before stamping the authenticated identity, so no client-supplied value can be forwarded to a shard.\n\nOperators should upgrade to a patched release. No configuration changes are required after upgrading.\n\n# Workarounds\n\nThere is no complete workaround other than upgrading. Deployments that terminate client connections at an external proxy capable of stripping `X-Remote-User`, `X-Remote-Group`, and all `X-Remote-Extra-*` headers from inbound requests before they reach the kcp front-proxy can mitigate exposure in the interim.\n\nCredit to [5ud0er](https://github.com/5ud0er) / Tarmo Technologies.",
  "id": "GHSA-c8w2-fgvx-vhv4",
  "modified": "2026-09-18T17:15:49Z",
  "published": "2026-09-18T17:15:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kcp-dev/kcp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kcp-dev/kcp/releases/tag/v0.31.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kcp-dev/kcp/releases/tag/v0.32.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace"
}

CVE-2026-61682 (GCVE-0-2026-61682)

Vulnerability from cvelistv5 – Published: 2026-09-18 16:11 – Updated: 2026-09-18 16:11

Title

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

Summary

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-290 - Authentication Bypass by Spoofing
CWE-302 - Authentication Bypass by Assumed-Immutable Data
CWE-348 - Use of Less Trusted Source

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/kcp-dev/kcp/security/advisorie…	x_refsource_CONFIRM
https://github.com/kcp-dev/kcp/commit/7437cdcfec8…	x_refsource_MISC
https://github.com/kcp-dev/kcp/commit/f913ee890fb…	x_refsource_MISC
https://github.com/kcp-dev/kcp/releases/tag/v0.31.4	x_refsource_MISC
https://github.com/kcp-dev/kcp/releases/tag/v0.32.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kcp-dev	kcp	Affected: < 0.31.4 Affected: >= 0.32.0, < 0.32.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "kcp",
          "vendor": "kcp-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.31.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.32.0, \u003c 0.32.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-302",
              "description": "CWE-302: Authentication Bypass by Assumed-Immutable Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-348",
              "description": "CWE-348: Use of Less Trusted Source",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T16:11:46.443Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4"
        },
        {
          "name": "https://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca"
        },
        {
          "name": "https://github.com/kcp-dev/kcp/commit/f913ee890fb2fd9fa78e50c43474b078bfb6aeff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kcp-dev/kcp/commit/f913ee890fb2fd9fa78e50c43474b078bfb6aeff"
        },
        {
          "name": "https://github.com/kcp-dev/kcp/releases/tag/v0.31.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kcp-dev/kcp/releases/tag/v0.31.4"
        },
        {
          "name": "https://github.com/kcp-dev/kcp/releases/tag/v0.32.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kcp-dev/kcp/releases/tag/v0.32.2"
        }
      ],
      "source": {
        "advisory": "GHSA-c8w2-fgvx-vhv4",
        "discovery": "UNKNOWN"
      },
      "title": "kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61682",
    "datePublished": "2026-09-18T16:11:46.443Z",
    "dateReserved": "2026-07-10T18:36:58.848Z",
    "dateUpdated": "2026-09-18T16:11:46.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-C8W2-FGVX-VHV4

Summary

Impact

Patches

Workarounds

CVE-2026-61682 (GCVE-0-2026-61682)

Tags

Sightings

Nomenclature

Related by attack behaviour