When Multitenancy Goes Wrong: A Deep Dive Into Kcp’s First CVE - Marvin Beckers, ClickHouse

This talk, presented by Marvin Beckers from ClickHouse, focuses on multitenancy challenges within kcp, a CNCF Sandbox project designed to manage Kubernetes-style APIs. The speaker delves into CVE-2025-29922, which escalates from a medium to a high severity vulnerability due to flaws in resource isolation. Beckers explains how the virtual workspaces feature was compromised, allowing service providers to manipulate resources beyond their permissions. Through this session, the audience gains insight into the discovery process of this vulnerability and the subsequent protective measures implemented to safeguard kcp users and their data.