CVE-2026-39429 is a high severity flaw (CVSS 8.2) in kcp, the Kubernetes like control plane. The cache server is exposed directly by the root shard and has no authentication or authorization, so anyone who can reach the root shard can read and write it. Fixed in 0.30.3 and 0.29.3.
What's affected
kcp before 0.30.3 on the 0.30 line, and before 0.29.3 on the 0.29 line, is affected. The fixed versions are 0.30.3 and 0.29.3.
The record describes the exposure as anyone who can access the root shard, so network reachability is the key variable.
How to check if you're exposed
Check the kcp version in your deployment manifests, container image tags or release binary, and compare with the fixed versions.
kubectl get pods -A -o jsonpath='{..image}' | tr ' ' '\n' | grep -i kcp
Then confirm who can reach the root shard on the network.
What to do now
- Upgrade to 0.30.3 or 0.29.3, matching your release line.
- Limit network access to the root shard to the components that need it.
- Review recent changes to cached data for anything unexpected.
- Check the release notes for upgrade guidance.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
This is CWE-862 (Missing Authorization), with CWE-302 (Authentication Bypass by Assumed-Immutable Data) also listed. A service that holds shared state needs to verify who is calling it. Here the cache server answered anyone who could connect, which turns network reach into read and write access.
Internal services are often left open on the assumption that the network is trusted. That assumption fails once any neighbor is compromised. The record does not flag this CVE as exploited in the wild.
Quick check
Who can exploit it?
Anyone who can access the root shard, per the record.
Which versions are fixed?
0.30.3 and 0.29.3.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
