CVE-2026-39429

Katalog CVE

CVSS 9.1 · Critical EPSS 0,54%

Kerentanan Authentication Bypass by Assumed-Immutable Data pada kcp. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.

Rincian

Terbit di NVD

8 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-302: Authentication Bypass by Assumed-Immutable Data
CWE-862: Missing Authorization

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kcp-dev/kcp/security/advisories/GHSA-3j3q-wp9x-585p exploit · mitigasi · advisory vendor
• https://github.com/kcp-dev/kcp/releases/tag/v0.29.3 release notes
• https://github.com/kcp-dev/kcp/releases/tag/v0.30.3 release notes