Skip to content
Heist/ feed
Back to feed
High

kcp's cache server is accessible without authentication or authorization checks

Type: advisorySources: OSV

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-39429
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 03:10 UTC · Revision 1

Source evidence

kcp's cache server is accessible without authentication or authorization checks

core-osv · Original source

Published 8 Apr 2026, 20:16 UTC

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.

osv:CVE-2026-39429
Complete source record
{
  "id": "4dda1bc368ca83dfec1420e4039c74c93788b770176743194b4c5c0f939f4bed",
  "url": "https://osv.dev/vulnerability/CVE-2026-39429",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "kcp's cache server is accessible without authentication or authorization checks",
    "summary": "kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.",
    "evidence": "osv:CVE-2026-39429",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-39429",
      "aliases": [
        "CVE-2026-39429",
        "GHSA-3j3q-wp9x-585p",
        "GO-2026-5088"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/kcp-dev/kcp",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "42f2e029c32246ffe4a3ed8aa2a35224e51ccdac"
                },
                {
                  "introduced": "b36d1ba3e5219c0531b8817f7fee8ddba7f3de2c"
                },
                {
                  "fixed": "d28209d4da15682cb99517a07766557e9655f1c8"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:kcp:kcp:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.29.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:kcp:kcp:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0.30.0"
                      },
                      {
                        "fixed": "0.30.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "42f2e029c32246ffe4a3ed8aa2a35224e51ccdac"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v0.29.3"
                  },
                  {
                    "range": [
                      {
                        "fixed": "d28209d4da15682cb99517a07766557e9655f1c8"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v0.30.3"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.30.2",
            "v0.29.2",
            "v0.29.1",
            "v0.30.1",
            "v0.29.0",
            "v0.30.0",
            "v0.29.0-rc.1",
            "v0.29.0-rc.0",
            "v0.28.0",
            "sdk/v0.28.0",
            "cli/v0.28.0",
            "v0.27.0",
            "sdk/v0.27.0",
            "cli/v0.27.0",
            "v0.27.0-rc.1",
            "sdk/v0.27.0-rc.1",
            "cli/v0.27.0-rc.1",
            "v0.27.0-rc.0",
            "sdk/v0.27.0-rc.0",
            "cli/v0.27.0-rc.0",
            "v0.26.0",
            "sdk/v0.26.0",
            "cli/v0.26.0",
            "v0.26.0-rc1",
            "sdk/v0.26.0-rc1",
            "cli/v0.26.0-rc1",
            "v0.25.0",
            "sdk/v0.25.0",
            "cli/v0.25.0",
            "v0.24.0",
            "sdk/v0.24.0",
            "cli/v0.24.0",
            "v0.23.0",
            "sdk/v0.23.0",
            "cli/v0.23.0",
            "v0.22.0",
            "sdk/v0.22.0",
            "v0.21.0",
            "sdk/v0.21.0",
            "v0.20.0",
            "sdk/v0.20.0",
            "v0.11.0",
            "pkg/apis/v0.11.0",
            "v0.11.0-alpha.1",
            "pkg/apis/v0.11.0-alpha.1",
            "v0.10.0",
            "pkg/apis/v0.10.0",
            "v0.11.0-alpha.0",
            "pkg/apis/v0.11.0-alpha.0",
            "v0.9.0",
            "pkg/apis/v0.9.0",
            "v0.8.0",
            "pkg/apis/v0.8.0",
            "v0.7.0",
            "pkg/apis/v0.7.0",
            "v0.6.0-alpha.0",
            "v0.5.0-alpha.1",
            "pkg/apis/v0.5.0-alpha.1",
            "v0.5.0-alpha.0",
            "v0.4.0-alpha.0",
            "v0.3.0-beta.1",
            "v0.3.0-alpha.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39429.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:53.515343760Z",
      "provider": "osv",
      "references": [
        "https://github.com/kcp-dev/kcp/releases/tag/v0.29.3",
        "https://github.com/kcp-dev/kcp/releases/tag/v0.30.3",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39429.json",
        "https://github.com/kcp-dev/kcp/security/advisories/GHSA-3j3q-wp9x-585p",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-39429"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-302",
          "CWE-862"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39429.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-39429",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 522087,
  "published_at": "2026-04-08T20:16:04.015+00:00"
}