CVE-2026-61682: kcp Control Plane Auth Bypass Vulnerability

CVE-2026-61682 Overview

CVE-2026-61682 is a critical authentication bypass vulnerability in kcp, a Kubernetes-like control plane for workloads beyond standard containers. The kcp front-proxy fails to strip inbound X-Remote-User, X-Remote-Group, and X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters or similar identity assertions, and the shard trusts them as authenticated. The flaw affects kcp versions prior to 0.31.4 and 0.32.2, and it is classified under [CWE-290: Authentication Bypass by Spoofing].

Critical Impact

Authenticated tenants can impersonate cluster administrators across workspaces, bypass RBAC, and read, write, or delete secrets, APIExports, APIBindings, and LogicalClusters.

Affected Products

• kcp versions prior to 0.31.4
• kcp versions prior to 0.32.2 (0.32.x branch)
• Deployments exposing the kcp front-proxy to tenant traffic

Discovery Timeline

• 2026-09-18 - CVE-2026-61682 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-61682

Vulnerability Analysis

kcp uses a front-proxy that authenticates incoming client requests and forwards them to backend shards. The shards trust request-header identity assertions from the proxy, following the standard Kubernetes requestheader authenticator pattern. The vulnerable code in pkg/proxy/authheaders/authheaders.go only stamps identity headers when a user context is present. It does not clear inbound identity headers when the user context is absent or on every request path.

An authenticated tenant can send a request that includes attacker-controlled X-Remote-Group, X-Remote-User, or X-Remote-Extra-* headers. The front-proxy forwards those headers to the shard unchanged. The shard then treats values such as system:masters, authorization.kcp.io/warrant, or authentication.kcp.io/scopes as verified identity claims. This grants cross-workspace impersonation and complete authorization bypass.

Root Cause

The root cause is missing header sanitization in the proxy request pipeline. The proxy relied on SetAuthHeaders to overwrite identity headers, but that function was only invoked when the request context carried a user. Requests without a resolved user context were forwarded with tenant-supplied headers intact.

Attack Vector

Exploitation requires only low-privileged authenticated access to the kcp front-proxy over the network. The attacker injects identity headers into any HTTP request. No user interaction is required, and the scope changes from the attacker's workspace to any resource on any shard.

// Security patch in pkg/proxy/authheaders/authheaders.go
// Introduces ClearAuthHeaders to strip inbound identity headers

// ClearAuthHeaders deletes any inbound copies of the request-header identity
// headers.
func ClearAuthHeaders(header http.Header, userHeader, groupHeader, extraHeaderPrefix string) {
    header.Del(userHeader)
    header.Del(groupHeader)
    lowerPrefix := strings.ToLower(extraHeaderPrefix)
    for key := range header {
        if strings.HasPrefix(strings.ToLower(key), lowerPrefix) {
            header.Del(key)
        }
    }
}

// SetAuthHeaders stamps the given authenticated user's identity onto the request
// headers, after deleting any inbound copies of the identity headers.
func SetAuthHeaders(header http.Header, user userinfo.Info, userHeader, groupHeader, extraHeaderPrefix string) {
    ClearAuthHeaders(header, userHeader, groupHeader, extraHeaderPrefix)
    // ... stamp identity headers ...
}

// Source: https://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca

The corresponding change in pkg/proxy/proxy.go ensures headers are cleared even when no user context exists:

return func(w http.ResponseWriter, r *http.Request) {
    if u, ok := request.UserFrom(r.Context()); ok {
        authheaders.SetAuthHeaders(r.Header, u, userHeader, groupHeader, extraHeaderPrefix)
    } else {
        authheaders.ClearAuthHeaders(r.Header, userHeader, groupHeader, extraHeaderPrefix)
    }
    delegate.ServeHTTP(w, r)
}
// Source: https://github.com/kcp-dev/kcp/commit/7437cdcfec8f927d1a9bf1b2dd1e075d038e27ca

Detection Methods for CVE-2026-61682

Indicators of Compromise

• Inbound HTTP requests to the kcp front-proxy containing X-Remote-User, X-Remote-Group, or X-Remote-Extra-* headers from tenant clients.
• Requests carrying group assertions such as system:masters, authorization.kcp.io/warrant, or authentication.kcp.io/scopes originating outside the proxy.
• Audit log entries on shards showing actions attributed to system:masters from unexpected workspaces.

Detection Strategies

• Enable Kubernetes audit logging on all kcp shards and alert on high-privilege operations performed by unexpected identities.
• Inspect front-proxy access logs or an in-path reverse proxy for request headers matching the X-Remote-* pattern from untrusted sources.
• Correlate cross-workspace resource access, particularly on secrets, APIExports, APIBindings, and LogicalClusters.

Monitoring Recommendations

• Deploy a Web Application Firewall (WAF) or reverse proxy in front of kcp that strips X-Remote-* headers from tenant traffic.
• Alert on any use of system:masters group membership in shard audit logs.
• Track anomalous read/write/delete activity against RBAC objects across tenant boundaries.

How to Mitigate CVE-2026-61682

Immediate Actions Required

• Upgrade kcp to 0.31.4 or 0.32.2 as soon as possible; these releases include the header-sanitization fix.
• Rotate any secrets, service account tokens, and credentials that may have been exposed in accessible workspaces.
• Review shard audit logs for unauthorized access performed via injected identity headers prior to patching.

Patch Information

The fix is delivered in kcp release v0.31.4 and kcp release v0.32.2. Technical details are documented in GitHub Security Advisory GHSA-c8w2-fgvx-vhv4. The patch introduces ClearAuthHeaders and invokes it on every request path in pkg/proxy/proxy.go.

Workarounds

• Place a trusted reverse proxy in front of kcp that unconditionally deletes X-Remote-User, X-Remote-Group, and any header starting with X-Remote-Extra- on inbound requests.
• Restrict network access to the kcp front-proxy to authenticated infrastructure paths until the upgrade is applied.
• Temporarily reduce tenant permissions and disable per-workspace required-group gating that relies on these headers.

# Example NGINX configuration to strip identity headers before reaching kcp
location / {
    proxy_set_header X-Remote-User "";
    proxy_set_header X-Remote-Group "";
    proxy_set_header X-Remote-Extra- "";
    # Remove any header beginning with X-Remote-Extra-
    more_clear_input_headers 'X-Remote-User' 'X-Remote-Group' 'X-Remote-Extra-*';
    proxy_pass https://kcp-front-proxy.internal;
}