External risk intelligence

kcp Cache Server Unauthorized Access Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-39429

The vulnerability affects a Kubernetes-like control plane component. Control planes, API servers, and related cache services are frequently deployed as internet-facing or edge-reachable services to facilitate remote management, orchestration, and API interaction, making public or external network exposure a common deployment pattern.

Kcp

before 0.29.30.30.0 to before 0.30.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the kcp control plane, a system used for Kubernetes-like operations beyond standard container workloads. This issue allows unauthorized access to the cache server, potentially enabling data reading and modification. The primary concern is to confirm if your environment utilizes this technology and is exposed.

Unauthenticated access to sensitive data.
Control plane integrity and confidentiality risk.
Assess kcp relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach the cache server by accessing the root shard of the kcp system, as it is directly exposed without any authentication or authorization. This exposure allows any party capable of reaching the root shard to read from and write to the cache server, potentially leading to unauthorized data access and manipulation.

Entry condition: Network access to the root shard.
Trigger point: Directly accessing the exposed cache server.
Resulting risk: Unauthorized data read and write.

Live Threat

Current exploitation, exposure, and threat context

When the kcp cache server is directly exposed by the root shard without authentication or authorization, unauthorized parties could read and write to this cache. This could impact the integrity and confidentiality of data stored within the cache, potentially affecting the behavior of the control plane when supported by the advisory.

Cache data integrity and confidentiality.
Direct network access to root shard.
Compromised control plane state.

Operational Fix

Recommended remediation, mitigation, and detection steps

The kcp control plane's cache server requires immediate attention from platform and security teams due to its unauthenticated and unautorized nature. Owners of kcp deployments must first identify all instances, assess their reachability and business criticality, and then coordinate remediation with vendor management or internal development teams based on risk.

Identify and confirm kcp instance ownership.
Verify network exposure and business criticality.
Plan and execute targeted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the kcp software platform?

kcp is a control plane designed to provide Kubernetes-style orchestration for diverse computing form factors and workloads that extend beyond traditional container environments. It acts as the central management brain for these systems, handling state and configuration. Because it manages complex operations, it often includes internal components like a cache server to improve performance and responsiveness across the managed infrastructure.

What does CVE-2026-39429 mean for security?

This vulnerability involves a missing authentication or authorization check, categorized as CWE-302 and CWE-862. Essentially, the system fails to verify the identity of anyone attempting to interact with the cache server. Because these security checks are absent, the server treats every request as legitimate, allowing unauthorized users to potentially read or modify the data residing within the cache.

How does an attacker trigger this vulnerability?

An attacker triggers this issue by establishing network connectivity to the root shard of the kcp system. Once they can reach the root shard, they can communicate directly with the cache server without providing credentials. It is important to note that this is not triggered by specific user actions or complex payloads; rather, it is a structural access flaw. If the service is unreachable via the network, the ability to exploit this path is effectively blocked.

Is my kcp instance at risk?

Halo Surface Signal indicates that control plane components, including cache services, are often deployed at the network edge or in internet-facing configurations to support remote orchestration. If your kcp root shard is accessible from outside your trusted internal network, your risk is elevated. You should determine if your specific deployment architecture exposes the root shard to broader network segments.

How do I respond to this threat?

The primary step is to identify all kcp instances within your environment and verify their network exposure. Once identified, prioritize updating to version 0.30.3 or 0.29.3, which contain the necessary fixes to enforce authentication. If immediate patching is not possible, work with your infrastructure teams to restrict network access to the root shard to authorized users only, effectively isolating the cache server from untrusted traffic until the update can be applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.