shared

Jun 23, 2026 GO-2026-6517

  GO-2026-6517: kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp

Jun 15, 2026 GO-2026-6517

  GO-2026-6517: kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp

Jul 2, 2026

Changes in this version

+ func ResolveLifecycleWorkspaceType(role string, id string, typeFrom func() (logicalcluster.Name, string, error), ...) (*tenancyv1alpha1.WorkspaceType, error)

+ func ServeProxy(writer http.ResponseWriter, request *http.Request, forwardedHost *url.URL, ...)