PT-2025-12365 · Kcp · Kcp

Published 2025-03-20 · Updated 2026-03-12 · CVE-2025-29922

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions kcp versions prior to 0.26.3

Description The issue allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources, even if there is no APIBinding in that workspace or the workspace owner has rejected a permission claim. This is possible because the vulnerability bypasses the requirement for an APIBinding to be created by the workspace owner, allowing unauthorized access.

Recommendations For versions prior to 0.26.3, update to version 0.26.3 or 0.27.0 to resolve the issue. As a temporary workaround, consider restricting access to the APIExport VirtualWorkspace to minimize the risk of exploitation. Avoid using the APIExport VirtualWorkspace until the issue is resolved by updating to a fixed version.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2026-00110

CVE-2025-29922

GHSA-W2RR-38WV-8RRP

GO-2025-3538

OPENSUSE-SU-2025:14937-1

Affected Products

Kcp

References · 56

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29922.json · Exploit
• https://osv.dev/vulnerability/GO-2025-3538 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29922 · Security Note
• https://osv.dev/vulnerability/GHSA-w2rr-38wv-8rrp · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00110 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29922 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14937-1 · Vendor Advisory
• https://github.com/kcp-dev/kcp · Note
• https://github.com/kcp-dev/kcp/pull/3338 · Note
• https://github.com/kcp-dev/kcp/security/advisories/GHSA-w2rr-38wv-8rrp · Note
• https://github.com/kcp-dev/kcp/commit/614ecbf35f11db00f65391ab6fbb1547ca8b5d38 · Note
• https://twitter.com/TweetThreatNews/status/1904299904094343563 · Twitter Post
• https://t.me/latest_high_impact_cve/2013 · Telegram Post
• https://suse.com/security/cve/CVE-2024-53348 · Note
• https://suse.com/security/cve/CVE-2025-27612 · Note