kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp

Description

References

• kcp-dev/kcp security advisory · ADVISORY
• kcp-dev/kcp commit 02134a2 · FIX
• kcp-dev/kcp#3599 · FIX
• kcp-dev/kcp release v0.28.3 · WEB

Altre vulnerabilità di github.com/kcp-dev/kcp

• CVE-2026-61682CRITICO 9.9kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2,…
• CVE-2026-39429CRITICO 9.1kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3,…
• GHSA-q6hv-wcjr-wp8hBASSOkcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace
• CVE-2025-29922CRITICO 9.6kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identi…
• GO-2024-3325kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp