CVE-2026-39429

CriticalCVSS 9.1/10Last modified Jul 24, 2026

Description

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-302 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-39437.3A vulnerability was found in H3C ACG1000-AK230 up to 20260227. This affects an unknown part of the file /webui/?aaa_portal_auth_local_submit CVE-2026-394328.2Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels. This iss CVE-2026-394336.5Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions.CVE-2026-394347.2Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.CVE-2026-394357.1Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions.CVE-2026-394367.1Cross-Site Request Forgery (CSRF) vulnerability in bgermann CformsII allows Cross Site Request Forgery. This issue affects CformsII: from n CVE-2026-394377.1Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.CVE-2026-394389.3Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions.CVE-2026-394396.5Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access Control Security Lev CVE-2026-39449.8A vulnerability was determined in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /att_ad CVE-2026-394409.9Improper Control of Generation of Code ('Code Injection') vulnerability in Funnelforms LLC FunnelFormsPro allows Remote Code Inclusion.This CVE-2026-394419.3Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.