Executive brief
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace
Affected products
- Go github.com/kcp-dev/kcp
Junglewise Threat Intelligence
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace
Severity: medium · CVSS 4 · Published 2025-09-26
Technologies: github.com/kcp-dev/kcp (Go). Vendors: Go.
Related threats
- kcp-dev kcp authentication bypass in cache server
- GO-2025-3985 - kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.c
- GO-2025-3538 - kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/k
- GO-2024-3325 - kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp
- kcp's impersonation allows access to global administrative groups