kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp

Description

References

• kcp-dev/kcp security advisory · ADVISORY
• kcp-dev/kcp commit 24ab5d4 · FIX
• kcp-dev/kcp#3206 · FIX

More vulnerabilities in github.com/kcp-dev/kcp

• CVE-2026-61682CRITICAL 9.9kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2,…
• CVE-2026-39429CRITICAL 9.1kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3,…
• GO-2025-3985kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.c…
• GHSA-q6hv-wcjr-wp8hLOWkcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace
• CVE-2025-29922CRITICAL 9.6kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identi…