kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp
{ "review_status": "UNREVIEWED", "url": "https://pkg.go.dev/vuln/GO-2025-3538" }