Executive brief
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp
Affected products
- Go github.com/kcp-dev/kcp
Junglewise Threat Intelligence
CVE-2025-29922: GO-2025-3538 - kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/k
CVE-2025-29922 · Severity: low · CVSS 3.1 · Published 2025-03-25
Technologies: github.com/kcp-dev/kcp (Go). Vendors: Go.
Related threats
- kcp-dev kcp authentication bypass in cache server
- GO-2025-3985 - kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.c
- kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace
- GO-2024-3325 - kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp
- kcp's impersonation allows access to global administrative groups