Kcp-dev vulnerabilities
Products
- Kcp 3
Newest
- kcp-dev kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace 9.9 Critical
- kcp kcp's cache server is accessible without authentication or authorization checks 8.2 High
- kcp-dev kcp kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace 9.6 Critical