{"metadata": {"vulnerability": "CVE-2025-29922", "count": 27, "kinds": {"milestone": 5, "sighting": 9, "kev": 0, "other": 13}}, "data": [{"timestamp": "2025-03-12T13:42:22.135Z", "date_only": false, "value": "2025-03-12T13:42:22.135Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-29922", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-03-20T17:49:57.425Z", "date_only": false, "value": "2025-03-20T17:49:57.425Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-29922", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2025-03-20T17:49:57.425Z", "date_only": false, "value": "2025-03-20T17:49:57.425Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2025-29922", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-20T18:15:19Z", "date_only": false, "value": "2025-03-20T18:15:19Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-W2RR-38WV-8RRP", "record": "GHSA-W2RR-38WV-8RRP", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2025-03-20T18:15:19.063Z", "date_only": false, "value": "2025-03-20T18:15:19.063", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-29922", "record": "FKIE_CVE-2025-29922", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-03-20T18:15:51.138Z", "date_only": false, "value": "2025-03-20T18:15:51.138004Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-29922", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-03-20T18:15:51.138Z", "date_only": false, "value": "2025-03-20T18:15:51.138004Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-29922", "record": "FKIE_CVE-2025-29922", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-03-20T18:16:20.624Z", "date_only": false, "value": "2025-03-20T18:16:20.624Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-29922", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-03-20T18:16:20.624Z", "date_only": false, "value": "2025-03-20T18:16:20.624Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-29922", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-03-20T18:20:52Z", "date_only": false, "value": "2025-03-20T18:20:52.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8255", "record": "CVE-2025-29922", "field": "creation_timestamp", "uuid": "094a1ee1-75a4-43a2-afd8-4f3bb2e82374", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-29922\n\ud83d\udd25 CVSS Score: 9.6 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)\n\ud83d\udd39 Description: kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By design, this should only be allowed when the workspace owner decides to give access to an API provider by creating an APIBinding. With this vulnerability, it is possible for an attacker to create and delete objects even if none of these requirements are satisfied, i.e. even if there is no APIBinding in that workspace at all or the workspace owner has created an APIBinding, but rejected a permission claim. A fix for this issue has been identified and has been published with kcp 0.26.3 and 0.27.0.\n\ud83d\udccf Published: 2025-03-20T17:49:57.425Z\n\ud83d\udccf Modified: 2025-03-20T17:49:57.425Z\n\ud83d\udd17 References:\n1. https://github.com/kcp-dev/kcp/security/advisories/GHSA-w2rr-38wv-8rrp\n2. https://github.com/kcp-dev/kcp/pull/3338\n3. https://github.com/kcp-dev/kcp/commit/614ecbf35f11db00f65391ab6fbb1547ca8b5d38", "url": "https://t.me/DarkWebInformer_CVEAlerts/8255", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-03-20T18:40:13.280Z", "date_only": false, "value": "2025-03-20T18:40:13.280592Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3lktdvxogex2g", "record": "CVE-2025-29922", "field": "creation_timestamp", "uuid": "50227c42-e14e-4aa9-b553-77d600434f70", "url": "https://bsky.app/profile/cyberalerts.bsky.social/post/3lktdvxogex2g"}, {"timestamp": "2025-03-20T18:49:06Z", "date_only": false, "value": "2025-03-20T18:49:06Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-W2RR-38WV-8RRP", "record": "GHSA-W2RR-38WV-8RRP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2025-03-20T18:49:06Z", "date_only": false, "value": "2025-03-20T18:49:06Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-W2RR-38WV-8RRP", "record": "GHSA-W2RR-38WV-8RRP", "field": "modified", "linked_record": true}, {"timestamp": "2025-03-20T19:00:50.322Z", "date_only": false, "value": "2025-03-20T19:00:50.322525Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/114196299759939165", "record": "CVE-2025-29922", "field": "creation_timestamp", "uuid": "5bb1b679-7059-4a00-9c17-b1b36ff78faa", "url": "https://infosec.exchange/users/cR0w/statuses/114196299759939165"}, {"timestamp": "2025-03-20T20:00:50Z", "date_only": false, "value": "2025-03-20T20:00:50.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Q4kJo2F2oL-NbaJrfC6LO8-y_S2Us6LVpftgoL4QtCPuQVY", "record": "CVE-2025-29922", "field": "creation_timestamp", "uuid": "0c1c3299-2ea6-44a5-a84e-7c85d2883019", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2025-03-20T20:48:25.443Z", "date_only": false, "value": "2025-03-20T20:48:25.443264Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/114196722739867314", "record": "CVE-2025-29922", "field": "creation_timestamp", "uuid": "e12bfa34-b5db-4f11-bd26-6c8b44f901e2", "url": "https://mastodon.social/users/CyberSignaler/statuses/114196722739867314"}, {"timestamp": "2025-03-20T21:04:12.372Z", "date_only": false, "value": "2025-03-20T21:04:12.372833Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lktlxbevqy2s", "record": "CVE-2025-29922", "field": "creation_timestamp", "uuid": "b7912f3d-3efd-4314-8276-6d355655476b", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3lktlxbevqy2s"}, {"timestamp": "2025-03-20T21:35:06Z", "date_only": false, "value": "2025-03-20T21:35:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/20766", "record": "CVE-2025-29922", "field": "creation_timestamp", "uuid": "27d90dcc-5fa5-4058-bd6f-0dcd3e88727b", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-29922 - KCP Unauthenticated Object Creation and Deletion Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-29922 \nPublished : March 20, 2025, 6:15 p.m. | 1\u00a0hour, 59\u00a0minutes ago \nDescription : kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By design, this should only be allowed when the workspace owner decides to give access to an API provider by creating an APIBinding. With this vulnerability, it is possible for an attacker to create and delete objects even if none of these requirements are satisfied, i.e. even if there is no APIBinding in that workspace at all or the workspace owner has created an APIBinding, but rejected a permission claim. A fix for this issue has been identified and has been published with kcp 0.26.3 and 0.27.0. \nSeverity: 9.6 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"20 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/20766"}, {"timestamp": "2025-03-21T11:00:08.697Z", "date_only": false, "value": "2025-03-21T11:00:08.697298Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnalerts.bsky.social/post/3lkv2o5mvyi23", "record": "CVE-2025-29922", "field": "creation_timestamp", "uuid": "748dd9ee-c15a-47ce-8230-b8501a17d14c", "url": "https://bsky.app/profile/vulnalerts.bsky.social/post/3lkv2o5mvyi23"}, {"timestamp": "2025-03-24T10:37:19.646Z", "date_only": false, "value": "2025-03-24T10:37:19.646362Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/andranglin.bsky.social/post/3ll4ks3qf2k2h", "record": "CVE-2025-29922", "field": "creation_timestamp", "uuid": "498645b4-bc08-48f4-9811-38df302aaf7d", "url": "https://bsky.app/profile/andranglin.bsky.social/post/3ll4ks3qf2k2h"}, {"timestamp": "2025-03-28T00:00:00Z", "date_only": false, "value": "2025-03-28T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14937-1", "record": "OPENSUSE-SU-2025:14937-1", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2025-03-28T00:00:00Z", "date_only": false, "value": "2025-03-28T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14937-1", "record": "OPENSUSE-SU-2025:14937-1", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2025-03-28T00:00:00Z", "date_only": false, "value": "2025-03-28T00:00:00Z", "kind": "other", "label": "Impact", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14937-1", "record": "OPENSUSE-SU-2025:14937-1", "field": "vulnerabilities.0.threats.0.date", "linked_record": true}, {"timestamp": "2025-03-28T00:00:00Z", "date_only": false, "value": "2025-03-28T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14937-1", "record": "OPENSUSE-SU-2025:14937-1", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-06-17T09:05:53.080Z", "date_only": false, "value": "2026-06-17T09:05:53.080", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-29922", "record": "FKIE_CVE-2025-29922", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-09-20T21:30:09Z", "date_only": false, "value": "2026-09-20T21:30:09Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14937-1", "record": "OPENSUSE-SU-2025:14937-1", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-09-20T21:30:09Z", "date_only": false, "value": "2026-09-20T21:30:09Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:14937-1", "record": "OPENSUSE-SU-2025:14937-1", "field": "document.tracking.current_release_date", "linked_record": true}], "metrics": {"as_of": "2026-11-09T22:07:49.776Z", "anchors": {"origin": {"timestamp": "2025-03-20T17:49:57.425Z", "date_only": false, "value": "2025-03-20T17:49:57.425Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-29922", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2025-03-20T17:49:57.425Z", "date_only": false, "value": "2025-03-20T17:49:57.425Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-29922", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2025-03-20T18:20:52Z", "date_only": false, "value": "2025-03-20T18:20:52.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8255", "record": "CVE-2025-29922", "field": "creation_timestamp", "uuid": "094a1ee1-75a4-43a2-afd8-4f3bb2e82374", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-29922\n\ud83d\udd25 CVSS Score: 9.6 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)\n\ud83d\udd39 Description: kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By design, this should only be allowed when the workspace owner decides to give access to an API provider by creating an APIBinding. With this vulnerability, it is possible for an attacker to create and delete objects even if none of these requirements are satisfied, i.e. even if there is no APIBinding in that workspace at all or the workspace owner has created an APIBinding, but rejected a permission claim. A fix for this issue has been identified and has been published with kcp 0.26.3 and 0.27.0.\n\ud83d\udccf Published: 2025-03-20T17:49:57.425Z\n\ud83d\udccf Modified: 2025-03-20T17:49:57.425Z\n\ud83d\udd17 References:\n1. https://github.com/kcp-dev/kcp/security/advisories/GHSA-w2rr-38wv-8rrp\n2. https://github.com/kcp-dev/kcp/pull/3338\n3. https://github.com/kcp-dev/kcp/commit/614ecbf35f11db00f65391ab6fbb1547ca8b5d38", "url": "https://t.me/DarkWebInformer_CVEAlerts/8255", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 1854.575, "hours": 0.5151597222222223, "days": 0.021464988425925927, "min_seconds": 1854.575, "max_seconds": 1854.575, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-03-20T17:49:57.425Z", "date_only": false, "value": "2025-03-20T17:49:57.425Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-29922", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2025-03-20T18:20:52Z", "date_only": false, "value": "2025-03-20T18:20:52.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8255", "record": "CVE-2025-29922", "field": "creation_timestamp", "uuid": "094a1ee1-75a4-43a2-afd8-4f3bb2e82374", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-29922\n\ud83d\udd25 CVSS Score: 9.6 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)\n\ud83d\udd39 Description: kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By design, this should only be allowed when the workspace owner decides to give access to an API provider by creating an APIBinding. With this vulnerability, it is possible for an attacker to create and delete objects even if none of these requirements are satisfied, i.e. even if there is no APIBinding in that workspace at all or the workspace owner has created an APIBinding, but rejected a permission claim. A fix for this issue has been identified and has been published with kcp 0.26.3 and 0.27.0.\n\ud83d\udccf Published: 2025-03-20T17:49:57.425Z\n\ud83d\udccf Modified: 2025-03-20T17:49:57.425Z\n\ud83d\udd17 References:\n1. https://github.com/kcp-dev/kcp/security/advisories/GHSA-w2rr-38wv-8rrp\n2. https://github.com/kcp-dev/kcp/pull/3338\n3. https://github.com/kcp-dev/kcp/commit/614ecbf35f11db00f65391ab6fbb1547ca8b5d38", "url": "https://t.me/DarkWebInformer_CVEAlerts/8255", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 51769072.351119, "hours": 14380.297875310833, "days": 599.1790781379514, "min_seconds": 51769072.351119, "max_seconds": 51769072.351119, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-03-20T17:49:57.425Z", "date_only": false, "value": "2025-03-20T17:49:57.425Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-29922", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-09T22:07:49.776Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 51767217.776119, "hours": 14379.782715588612, "days": 599.1576131495254, "min_seconds": 51767217.776119, "max_seconds": 51767217.776119, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2025-03-20T18:20:52Z", "date_only": false, "value": "2025-03-20T18:20:52.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8255", "record": "CVE-2025-29922", "field": "creation_timestamp", "uuid": "094a1ee1-75a4-43a2-afd8-4f3bb2e82374", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-29922\n\ud83d\udd25 CVSS Score: 9.6 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)\n\ud83d\udd39 Description: kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By design, this should only be allowed when the workspace owner decides to give access to an API provider by creating an APIBinding. With this vulnerability, it is possible for an attacker to create and delete objects even if none of these requirements are satisfied, i.e. even if there is no APIBinding in that workspace at all or the workspace owner has created an APIBinding, but rejected a permission claim. A fix for this issue has been identified and has been published with kcp 0.26.3 and 0.27.0.\n\ud83d\udccf Published: 2025-03-20T17:49:57.425Z\n\ud83d\udccf Modified: 2025-03-20T17:49:57.425Z\n\ud83d\udd17 References:\n1. https://github.com/kcp-dev/kcp/security/advisories/GHSA-w2rr-38wv-8rrp\n2. https://github.com/kcp-dev/kcp/pull/3338\n3. https://github.com/kcp-dev/kcp/commit/614ecbf35f11db00f65391ab6fbb1547ca8b5d38", "url": "https://t.me/DarkWebInformer_CVEAlerts/8255", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-09T22:07:49.776Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}