CVE-2025-29922: Github.com/kcp dev/kcp Kcp Allows Unauthorized Creation And Vulnerability
CRITICALCVE-2025-29922 is a CRITICAL (CVSS 9.6) kcp allows unauthorized creation and vulnerability (CWE-285: Improper Authorization) affecting Github.com/kcp dev/kcp libraries in the Go ecosystem. The issue involves kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through apiexport virtual workspace. Remediation is available by upgrading affected packages to version 0.26.3.
CVE-2025-29922 at a Glance
Security Impact
CVSS: 9.6
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
How to Fix CVE-2025-29922
To remediate this vulnerability, upgrade all affected Github.com/kcp dev/kcp dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/kcp-dev/kcp to 0.26.3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/kcp-dev/kcpHow to Check if You Are Affected
To determine whether your application is affected by CVE-2025-29922, inspect your project dependencies for Github.com/kcp dev/kcp:
inspect dependencies for github.com/kcp-dev/kcpAnalyze the terminal output to locate any version of Github.com/kcp dev/kcp in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.26.3), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-285: Improper Authorization, where the product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. In Github.com/kcp dev/kcp, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-29922 Affected Github.com/kcp dev/kcp Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/kcp-dev/kcp
|
Go |
< 0.26.3
|
0.26.3
|
References
Frequently Asked Questions
What is CVE-2025-29922?
Which Github.com/kcp dev/kcp versions are affected?
What version fixes CVE-2025-29922?
Is github.com/kcp-dev/kcp affected?
What is the CVSS score of CVE-2025-29922?
What CWE is associated with CVE-2025-29922?
How can I check Go dependencies for CVE-2025-29922?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-w2rr-38wv-8rrp",
"modified" : "2025-03-20T18:49:06Z",
"published" : "2025-03-20T18:49:06Z",
"aliases" : [ "CVE-2025-29922" ],
"summary" : "kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace",
"details" : "### Impact\n\nThe `APIExport` Virtual Workspace can be used to manage objects in workspaces that bind that `APIExport` for resources defined in the `APIExport` or specified and accepted via permission claims. This allows an API provider (via their `APIExport`) scoped down access to workspaces of API consumers to provide their services properly.\n\nThe identified vulnerability allows creating or deleting an object via the `APIExport` VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By design, this should only be allowed when the workspace owner decides to give access to an API provider by creating an APIBinding.\n\nWith this vulnerability, it is possible for an attacker to create and delete objects even if none of these requirements are satisfied, i.e. even if there is no APIBinding in that workspace at all or the workspace owner has created an APIBinding, but rejected a permission claim.\n\n### Patches\n\nA fix for this issue has been identified and has been published with kcp 0.26.3 and 0.27.0.\n\n### Workarounds\n\nFor users unable to upgrade to one of the patched versions, the following guidance can be given:\n\n- Minimise the set of people with `apiexport/content` sub-resource access to `APIExport` resources. Be aware that this has to apply to all workspaces to be effective.\n- Filter incoming requests in a reverse proxy with a similar logic as the authorizer added in the referenced pull request.\n\n### References\n\nSee pull request (https://github.com/kcp-dev/kcp/pull/3338).",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/kcp-dev/kcp"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.26.3"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/kcp-dev/kcp/security/advisories/GHSA-w2rr-38wv-8rrp"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-29922"
}, {
"type" : "WEB",
"url" : "https://github.com/kcp-dev/kcp/pull/3338"
}, {
"type" : "WEB",
"url" : "https://github.com/kcp-dev/kcp/commit/614ecbf35f11db00f65391ab6fbb1547ca8b5d38"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/kcp-dev/kcp"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-285" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2025-03-20T18:49:06Z",
"nvd_published_at" : "2025-03-20T18:15:19Z"
}
}