CVE-2026-39429

OVERVIEW CVE-2026-39429 affects kcp, a Kubernetes-like control plane designed for workloads beyond traditional container environments. The vulnerability stems from the cache server being directly exposed on the root shard without any authentication or authorization mechanisms, allowing unauthenticated access to read and write operations. This flaw impacts all versions prior to 0.30.3 and 0.29.3, where patches have been released to remediate the issue. SEVERITY This vulnerability carries a critical CVSS score of 9.1, reflecting its high risk profile. The attack vector is network-based with low complexity, requiring no privileges or user interaction, making it easily exploitable by any actor with network access to the root shard. The impact includes both high confidentiality and integrity compromise, as attackers can read sensitive cached data and modify it, though availability is not directly affected. The FAUCET Risk Score of 53.0/100 indicates moderate-to-high contextual risk. EXPLOITATION STATUS There are currently no indications of active exploitation, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and appears inactive on threat intelligence hot lists. The EPSS score of 0.000780000 suggests minimal empirical exploit probability, though this should not diminish the urgency of patching given the critical severity rating and the trivial nature of the exploitation required. Organizations running affected kcp versions should prioritize immediate updates to the patched releases.