Executive brief
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp
Affected products
- Go github.com/kcp-dev/kcp
Junglewise Threat Intelligence
GO-2025-3985 - kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.c
Severity: info · Published 2025-10-23
Technologies: github.com/kcp-dev/kcp (Go). Vendors: Go.
Related threats
- kcp-dev kcp authentication bypass in cache server
- kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace
- GO-2025-3538 - kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/k
- GO-2024-3325 - kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp
- kcp's impersonation allows access to global administrative groups