A critical authentication bypass vulnerability in the kcp control plane allows authenticated users to escalate privileges to system administrator levels, posing a severe risk to cluster security.

This flaw stems from the failure of the kcp front-proxy to strip inbound identity headers like X-Remote-Group before forwarding requests to shards. An authenticated tenant can inject headers to spoof identity assertions, effectively bypassing authorization checks and gaining control over secrets, RBAC data, and cluster resources.

The ability for a standard tenant to impersonate privileged users results in total compromise of the Kubernetes-like control plane. Given the CVSS score of 9.9, this vulnerability represents an existential threat to multi-tenant environments, as attackers can exfiltrate sensitive secrets, modify infrastructure configurations, or delete critical business logic.

Immediate Action: Upgrade the kcp deployment to version 0.31.4 or 0.32.2 immediately to implement the required header sanitization logic.

Proactive Monitoring: Audit Kubernetes and kcp access logs for suspicious identity header injection patterns or unauthorized cross-workspace resource access.

Compensating Controls: Ensure strict network segmentation for the kcp front-proxy and utilize mTLS to verify identity assertions between components if the patch cannot be applied immediately.

Public Exploit Available: Unknown

Organizations utilizing kcp must prioritize this update as a critical security task. The vulnerability allows for full administrative bypass, meaning any delay in patching significantly increases the risk of a total control plane takeover by malicious tenants.