github.com/kcp-dev/kcp vulnerabilities (Go)
5 vulnerabilities.
-
github.com/kcp-dev/kcpGo kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace 9.9 Critical -
github.com/kcp-dev/kcpGo kcp's cache server is accessible without authentication or authorization checks 8.2 High -
github.com/kcp-dev/kcpGo kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace 2.3 Low -
github.com/kcp-dev/kcpGo kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace 9.6 Critical -
github.com/kcp-dev/kcpGo kcp's impersonation allows access to global administrative groups 6.4 Medium