Skip to content
Heist/ feed
CriticalFix available

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

Type: advisorySource: OSV1 source record

# Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own `X-Remote-Group` and `X-Remote-Extra-*` headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to escalate to cluster administrator (`system:masters`) and read, write, or delete resources in any workspace on the shard. This is a complete multi-tenant isolation and authorization bypass. ## Impact In a sharded kcp deployment, external clients reach shards through the front-proxy, which authenticates the client and then forwards the resulting identity to the shard using Kubernetes request-header authentication (`X-Remote-User` / `X-Remote-Group` / `X-Remote-Extra-*`). The shard trusts these headers because they arrive over the front-proxy's mutually-authenticated connection. Because the front-proxy appended its identity headers instead of replacing them — and never removed any copies the client sent — an authenticated attacker could smuggle forged identity headers through to the shard. With this, an attacker holding any ordinary credential (client certificate, OIDC token, or service-account token) and no special privileges could: - assert `X-Remote-Group: system:masters` and act as cluster super-user, bypassing the entire kcp authorizer chain in every workspace on the shard; - forge `authorization.kcp.io/warrant` to assume an arbitrary user/group identity via kcp's delegated-ide

Announced Source revision 1
Original source ↗

GHSA-c8w2-fgvx-vhv4

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-c8w2-fgvx-vhv4

github.com/kcp-dev/kcp

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
0.31.4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

github.com/kcp-dev/kcp

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
0.32.2

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "0.31.4"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/kcp-dev/kcp",
      "purl": "pkg:golang/github.com/kcp-dev/kcp",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-c8w2-fgvx-vhv4/GHSA-c8w2-fgvx-vhv4.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0.32.0"
          },
          {
            "fixed": "0.32.2"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/kcp-dev/kcp",
      "purl": "pkg:golang/github.com/kcp-dev/kcp",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-c8w2-fgvx-vhv4/GHSA-c8w2-fgvx-vhv4.json"
    }
  }
]
Related CVEs
CVE-2026-61682

Source reference: /aliases

Publisher severity

critical

Source reference: /database_specific/severity

Event
#23412 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement