---
title: "CVE-2026-61682: kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace"
url: https://erroneo.us/security/cve/CVE-2026-61682/
description: "CVE-2026-61682 (github.com/kcp-dev/kcp (Go)): kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-09-18
date_modified: 2026-09-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-61682"
kev: false
cvss: 9.9
epss: 0.00384
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-61682: kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.4% , percentile 31: FIRST’s model estimates a 0.4% chance of exploitation activity in the next 30 days, higher than 31% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes github.com/kcp-dev/kcp (Go) < 0.31.4, fixed in 0.31.4 ; github.com/kcp-dev/kcp (Go) >= 0.32.0, < 0.32.2, fixed in 0.32.2 . Check your lockfile, including transitive dependencies.

## What it is

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra- identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.

## Affected packages

- Go `github.com/kcp-dev/kcp` < 0.31.4 → fixed: 0.31.4
- Go `github.com/kcp-dev/kcp` >= 0.32.0, < 0.32.2 → fixed: 0.32.2

## Affected products (CVE record)

- kcp-dev kcp: < 0.31.4, >= 0.32.0, < 0.32.2

## Severity

- GitHub_M CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.38% probability of exploitation activity in the next 30 days; percentile 31.

## Sources

- [GitHub Advisory GHSA-c8w2-fgvx-vhv4](https://github.com/advisories/GHSA-c8w2-fgvx-vhv4)
- [CVE.org record CVE-2026-61682](https://www.cve.org/CVERecord?id=CVE-2026-61682)
- [NVD entry CVE-2026-61682](https://nvd.nist.gov/vuln/detail/CVE-2026-61682)
- [github.com](https://github.com/kcp-dev/kcp/security/advisories/GHSA-c8w2-fgvx-vhv4)
- [github.com](https://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca)
- [github.com](https://github.com/kcp-dev/kcp/commit/f913ee890fb2fd9fa78e50c43474b078bfb6aeff)
- [github.com](https://github.com/kcp-dev/kcp/releases/tag/v0.31.4)
- [github.com](https://github.com/kcp-dev/kcp/releases/tag/v0.32.2)

---
Source page: https://erroneo.us/security/cve/CVE-2026-61682/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt