CVE-2026-39429 kcp's cache server is accessible without authentication or authorization checks
Attackers can read and write to the cache server without authentication because the root shard exposes it without checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39429?
CVE-2026-39429 is a high-severity missing authorization vulnerability in kcp-dev kcp, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.
Which versions are affected by CVE-2026-39429?
5 open source packages ship an affected version, including github.com/kcp-dev/kcp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kcp-dev/kcp Go | All versions | 0.29.3, 0.30.3 |
github.com/kcp-dev/kcp Go | All versions | 0.29.3 |
github.com/kcp-dev/kcp Go | All versions | 0.29.3 |
github.com/kcp-dev/kcp Go | From 0.30.0 | 0.30.3 |
github.com/kcp-dev/kcp Go | From 0.30.0 | 0.30.3 |
Products include Kcp Kcp.
How do I fix CVE-2026-39429?
Upgrade github.com/kcp-dev/kcp to a fixed version for your release line: 0.29.3 or 0.30.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-39429 being exploited?
There is no known exploitation of CVE-2026-39429 in the wild and no public exploit code.
Sources
Also known as GHSA-3j3q-wp9x-585p, GO-2026-5088.