https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:13:03 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-290514 EUVD-2026-290514 https://cve.radiocsirt.org/vuln/euvd-2026-290514 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39429 <p>kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.</p> <p>kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-39429 https://cve.radiocsirt.org/vuln/ghsa-3j3q-wp9x-585p <p><strong>Affected:</strong> Go: github.com/kcp-dev/kcp</p> <p>### Summary</p> <p>The cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server.</p> <p>### Details</p> <p>The cache server is routed in the pre-mux chain in the shard code. The preHandlerChainMux is handled before any authn/authz in the cache server: https://github.com/kcp-dev/kcp/blob/aaf93d59cbcd0cefb70d94bd8959ce390547c4a2/pkg/server/config.go#L514-L518</p> <p>This results in the cache server being proxied before any authn/authz in the handler chain takes place.</p> <p>### Attack Vectors</p> <p>#### 1. Unauthenticated Read Access (Primary) An attacker can read all replicated resources from the cache without any credentials. This exposes:</p> <p>| Category | Resources | Severity | Reason | |---|---|---|---| | RBAC | clusterroles, clusterrolebindings (filtered by annotation) | High | Only subset with `internal.kcp.io/replicate` annotation: access rules, APIExport bind/content rules, WorkspaceType use rules. Reveals permission structure for API access and tenancy. Roles/RoleBindings NOT replicated. | | Infrastructure | logicalclusters, shards | High | Reveals full cluster topology and shard configuration | | API surface | apiexports, apiexportendpointslices, apiresourceschemas | High | Reveals all exported APIs and their network endpoints | | Admission control | mutatingwebhookconfigurations, validatingwebhookconfigurations, validatingadmissionpolicies | High | Reveals admission po…</p> <p><strong>Affected:</strong> Go: github.com/kcp-dev/kcp</p> <p>### Summary</p> <p>The cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server.</p> <p>### Details</p> <p>The cache server is routed in the pre-mux chain in the shard code. The preHandlerChainMux is handled before any authn/authz in the cache server: https://github.com/kcp-dev/kcp/blob/aaf93d59cbcd0cefb70d94bd8959ce390547c4a2/pkg/server/config.go#L514-L518</p> <p>This results in the cache server being proxied before any authn/authz in the handler chain takes place.</p> <p>### Attack Vectors</p> <p>#### 1. Unauthenticated Read Access (Primary) An attacker can read all replicated resources from the cache without any credentials. This exposes:</p> <p>| Category | Resources | Severity | Reason | |---|---|---|---| | RBAC | clusterroles, clusterrolebindings (filtered by annotation) | High | Only subset with `internal.kcp.io/replicate` annotation: access rules, APIExport bind/content rules, WorkspaceType use rules. Reveals permission structure for API access and tenancy. Roles/RoleBindings NOT replicated. | | Infrastructure | logicalclusters, shards | High | Reveals full cluster topology and shard configuration | | API surface | apiexports, apiexportendpointslices, apiresourceschemas | High | Reveals all exported APIs and their network endpoints | | Admission control | mutatingwebhookconfigurations, validatingwebhookconfigurations, validatingadmissionpolicies | High | Reveals admission po…</p> https://cve.radiocsirt.org/vuln/ghsa-3j3q-wp9x-585p