CVE-2026-61682 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
Authenticated clients can inject identity headers to impersonate system:masters, bypassing authorization to read, write, or delete resources across workspaces.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61682?
CVE-2026-61682 is a critical authentication bypass vulnerability in kcp-dev kcp, published on 18 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.
Which versions are affected by CVE-2026-61682?
5 open source packages ship an affected version, including github.com/kcp-dev/kcp.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kcp-dev/kcp Go | All versions | 0.31.4, 0.32.2 |
github.com/kcp-dev/kcp Go | All versions | 0.31.4 |
github.com/kcp-dev/kcp Go | All versions | 0.31.4 |
github.com/kcp-dev/kcp Go | From 0.32.0 | 0.32.2 |
github.com/kcp-dev/kcp Go | From 0.32.0 | 0.32.2 |
How do I fix CVE-2026-61682?
Upgrade github.com/kcp-dev/kcp to a fixed version for your release line: 0.31.4 or 0.32.2.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-61682 being exploited?
There is no known exploitation of CVE-2026-61682 in the wild and no public exploit code.
Sources
Also known as GHSA-c8w2-fgvx-vhv4, GO-2026-6517.