Affected by GO-2024-3325 and 4 other vulnerabilities

GO-2024-3325: kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp

GO-2025-3538: kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp

GO-2025-3985: kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp

GO-2026-5088: kcp's cache server is accessible without authentication or authorization checks in github.com/kcp-dev/kcp

GO-2026-6517: kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp

authentication

package

v0.4.0-alpha.0 Latest Latest Go to latest Published: May 3, 2022 License: Apache-2.0 Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/kcp-dev/kcp

Links

Documentation ¶

Index ¶

func NewUnsafeNonLookupServiceAccountAuthenticator(keyfiles []string, boundIssuers []string, apiAudiences authenticator.Audiences) (authenticator.Request, error)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func NewUnsafeNonLookupServiceAccountAuthenticator ¶

func NewUnsafeNonLookupServiceAccountAuthenticator(keyfiles []string, boundIssuers []string, apiAudiences authenticator.Audiences) (authenticator.Request, error)

NewUnsafeNonLookupServiceAccountAuthenticator creates an service account authenticator that is not looking up service accounts and is hence unsafe for real authentication. But the returned authentication response can be used for non-critical purposes.

Types ¶

This section is empty.

Source Files ¶

View all Source files

serviceaccount.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL