PT-2026-31352 · Kcp · Kcp

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-39429

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions kcp versions prior to 0.30.3 and prior to 0.29.3

Description Prior to versions 0.30.3 and 0.29.3, the cache server in kcp is directly exposed by the root shard without authentication or authorization. This allows anyone who can access the root shard to read and write to the cache server. An attacker can read all replicated resources from the cache, including RBAC data, cluster topology, API surfaces, admission control configurations, tenancy information, and cache metadata. A race condition exists that could allow temporary privilege escalation through full CRUD operations on the cache server, although practical exploitability is low. The replication controller acts as a self-healing mechanism, deleting injected objects almost instantly.

Recommendations Upgrade to kcp version 0.30.3 or later. Upgrade to kcp version 0.29.3 or later.

Fix

Missing Authentication

Missing Authorization

Weakness Enumeration

CWE-306

CWE-862

CWE-302

Related Identifiers

CVE-2026-39429

GHSA-3J3Q-WP9X-585P

Affected Products

Kcp

References · 7

• https://github.com/kcp-dev/kcp/security/advisories/GHSA-3j3q-wp9x-585p · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3j3q-wp9x-585p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39429 · Security Note
• https://github.com/kcp-dev/kcp/releases/tag/v0.30.3 · Note
• https://github.com/kcp-dev/kcp/releases/tag/v0.29.3 · Note
• https://github.com/kcp-dev/kcp · Note
• https://t.me/CVEtracker/50082 · Telegram Post