CPE
The kcp front-proxy fails to sanitize inbound X-Remote-* identity headers, allowing authenticated attackers to perform privilege escalation to system:masters and bypass multi-tenant authorization.