CVE-2026-39429 - Vulnerability Analysis

Overview

kcp < 0.30.3 and < 0.29.3 contains a broken access control vulnerability caused by unauthenticated and unauthorized access to the cache server exposed by the root shard, letting attackers read and write cache data, exploit requires access to the root shard.

Severity & Score

Impact

Attackers with root shard access can read and modify cache data, potentially compromising system integrity and confidentiality.

Mitigation

Update to version 0.30.3 or 0.29.3 or later.

References

• https://github.com/kcp-dev/kcp/releases/tag/v0.29.3
• https://github.com/kcp-dev/kcp/releases/tag/v0.30.3
• https://github.com/kcp-dev/kcp/security/advisories/GHSA-3j3q-wp9x-585p

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner