CVE-2026-39429CWE-302CWE-862

kcp's cache server is accessible without authentication or authorization checks

High · published April 8, 2026

CVSS v3.1
8.2
EPSS
1%
Percentile
44.7
In the wild
Unconfirmed
What it is

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00541 · 44.7th percentile
Weaknesses
CWE-302 · Authentication Bypass by Assumed-Immutable Data; CWE-862 · Missing Authorization
Published
2026-04-08T20:16Z
EPSS history
Timeline
  • 08 APR 20:16Z
    kcp's cache server is accessible without authentication or authorization checks
    cvelistv5