The vulnerability identified as CVE-2026-39429 affects kcp versions prior to 0.30.3 and 0.29.3. The root shard exposes the cache server without implementing authentication or authorization controls, enabling unauthorized users with access to the root shard to perform read and write operations on the cache server. This is classified under CWE-862 (Missing Authorization) and CWE-302 (Authentication Bypass). The CVSS 3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability is addressed by updating to versions 0.30.3 or 0.29.3 where proper access controls are enforced.

An attacker who can access the root shard in affected versions of kcp can read and modify cache server data without any authentication or authorization. This leads to a high confidentiality impact and a low integrity impact. There is no impact on availability. The vulnerability could allow unauthorized disclosure and partial modification of sensitive data managed by the cache server.

This vulnerability is fixed in kcp versions 0.30.3 and 0.29.3. Users should upgrade to one of these versions or later to ensure proper authentication and authorization are enforced on the cache server. Patch status is confirmed fixed in these versions. No additional mitigations are indicated by the vendor advisory.