github.com/kcp-dev/kcp
Go · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace | github.com/kcp-dev/kcp | Go | Critical | Fix reported | |
| kcp's cache server is accessible without authentication or authorization checks | github.com/kcp-dev/kcp | Go | High | Fix reported | |
| kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace | github.com/kcp-dev/kcp | Go | Low | Fix reported | |
| kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace | github.com/kcp-dev/kcp | Go | Critical | Fix reported | |
| kcp's impersonation allows access to global administrative groups | github.com/kcp-dev/kcp | Go | Medium | Fix reported |