Kcp (< 0.31.4, >= 0.32.0, < 0.32.2)

The kcp front-proxy fails to sanitize inbound X-Remote-* identity headers, allowing authenticated attackers to perform privilege escalation to system:masters and bypass multi-tenant authorization.