Critical security flaw in kcp front-proxy allows identity header injection

The kcp-dev/kcp project has disclosed a critical vulnerability, tracked as GHSA-c8w2-fgvx-vhv4, in its front-proxy component. According to the GitHub Security Advisory database, the front-proxy fails to strip inbound X-Remote-* identity headers, enabling any authenticated client to inject groups, warrants, and impersonate the system:masters role in any workspace. This flaw allows a low-privilege user to escalate to cluster administrator and bypass multi-tenant isolation and authorization mechanisms.

Operators should carefully evaluate the impact of this vulnerability on their deployments, especially in sharded environments where external clients interact with shards via the front-proxy. Before applying the patch, ensure that no untrusted or overly permissive authentication mechanisms are in place, as these could exacerbate the risk. Additionally, review logs for suspicious activity, such as unexpected identity assertions or unauthorized access patterns, which may indicate exploitation of this flaw. This issue highlights the importance of strict header validation and sanitization in multi-tenant systems.