kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp
{ "url": "https://pkg.go.dev/vuln/GO-2025-3538", "review_status": "UNREVIEWED" }
"https://vuln.go.dev/ID/GO-2025-3538.json"