Vulnerability details

CVE-2025-29922

kcp-dev kcp

kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

CVSS 3.1

9.6Critical

Official description

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By design, this should only be allowed when the workspace owner decides to give access to an API provider by creating an APIBinding. With this vulnerability, it is possible for an attacker to create and delete objects even if none of these requirements are satisfied, i.e. even if there is no APIBinding in that workspace at all or the workspace owner has created an APIBinding, but rejected a permission claim. A fix for this issue has been identified and has been published with kcp 0.26.3 and 0.27.0.

CVSS scores

Score	Version	Source	Vector
9.6Critical	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
kcp-dev	kcp	< 0.26.3	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/kcp-dev/kcp/security/advisories/GHSA-w2rr-38wv-8rrp x_refsource_CONFIRM
https://github.com/kcp-dev/kcp/pull/3338 x_refsource_MISC
https://github.com/kcp-dev/kcp/commit/614ecbf35f11db00f65391ab6fbb1547ca8b5d38 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-03-20
Last updated: 2025-03-20
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.37%

Probability of exploitation in 30 days

31.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-285
Improper Authorization