# kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

kcp front-proxy appended rather than replaced X-Remote-* identity headers, letting any authenticated tenant forge system:masters and access every workspace on a shard.

- Payout: Research
- Severity: critical
- Program: kcp
- Found by: 5ud0er
- Disclosed: 2026-09-18
- CVE: CVE-2026-61682
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-c8w2-fgvx-vhv4
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-c8w2-fgvx-vhv4
- Tags: area:cloud domain:cloud domain:infra impact:internal-access impact:privesc kind:research platform:ghsa sev:critical tech:go tech:kubernetes technique:source-review vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** kcp front-proxy / shard request-header authentication
**Root cause:** The front-proxy appended its authenticated identity headers to inbound requests instead of stripping client-supplied X-Remote-User/X-Remote-Group/X-Remote-Extra-* headers, and the shard trusted all copies arriving over the mTLS proxy connection.
**Steps:**
1. Obtain any ordinary credential (client cert, OIDC token, or service-account token) valid at the kcp front-proxy.
2. Send a request through the front-proxy to any shard with injected headers such as `X-Remote-Group: system:masters`, `X-Remote-Extra-authorization.kcp.io/warrant`, and `X-Remote-Extra-authentication.kcp.io/scopes`.
3. The front-proxy authenticates the client, appends its own identity headers, and forwards the request without removing the client-supplied copies.
4. The shard's request-header authenticator reads the forged headers and treats the caller as the asserted identity.
5. Perform read/write/delete operations against resources in any workspace on the shard.
**Exploitation:** Any authenticated low-privilege tenant smuggles forged identity headers past the front-proxy to the shard; asserting `system:masters` bypasses the kcp authorizer chain, and forged warrant/scope extras allow impersonating arbitrary users or escaping workspace scoping, yielding full cross-tenant read/write/delete.
**Escalation:** Chained header forgery with kcp's delegated-identity warrant mechanism and scope extras to escape service-account workspace confinement and satisfy per-workspace required-group gating.
**Insight:** When a proxy authenticates and then forwards identity via request headers, check whether it replaces or merely appends them — any client-supplied copy of the same header namespace survives to the backend that trusts it.