What’s Vulnerable › Vulnerabilities

CVE-2026-39429: kcp's cache server is accessible without authentication or authorization checks

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-08 · updated 2026-07-24
• Weakness: CWE-302

Description

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.

Affected products

• kcp-dev kcp: before 0.29.3; from 0.30.0 before 0.30.3 — fixed in 0.29.3, 0.30.3

How to fix

Upgrade to a fixed version: kcp-dev kcp 0.29.3, 0.30.3. Check the vendor advisory for mitigations.

References

• https://github.com/kcp-dev/kcp/releases/tag/v0.29.3
• https://github.com/kcp-dev/kcp/releases/tag/v0.30.3
• https://github.com/kcp-dev/kcp/security/advisories/GHSA-3j3q-wp9x-585p

Get alerted when CVE-2026-39429 or the next vulnerability affects your stack