VULNERABILITY INTELLIGENCE

CVE-2026-39429

CVSS score8.2 HIGH

EPSS probability0.44%

CISA KEVNot currently listed

Published2026-04-08

Last modified2026-07-24

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Description

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.

Weakness classification

CWE-302: Authentication Bypass by Assumed-Immutable Data
CWE-862: Missing Authorization

Primary references

security-advisories@github.com — Release Notes
security-advisories@github.com — Release Notes
security-advisories@github.com — Exploit, Mitigation, Vendor Advisory