CVE-2026-39429

kcp's cache server is accessible without authentication or authorization checks

State: Published
Severity: 8.2 High
Published: Apr 8, 2026
Updated: Apr 10, 2026
Reserved: Apr 7, 2026

Description

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N	GitHub_M

Weaknesses

CWE-862 Missing Authorization
CWE-302 Authentication Bypass by Assumed-Immutable Data

Affected Products

Product	Versions
kcpkcp-dev	>= 0.30.0, < 0.30.3Affected < 0.29.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.