CVE-2026-62246

HighCVSS 8.5

Published: 30/07/2026(UTC)Updated: 01/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

In Kamaji, the Hosted Control Plane Manager for Kubernetes, prior to version 26.7.4-edge, the GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername() functions use lossy namespace-and-name normalization, causing identifier collisions. This allows distinct tenants to share control-plane state and read, modify, or destroy another tenant's Kubernetes data.

Risk Assessment

The risk involves unauthorized access to other tenants' data, potentially leading to integrity and confidentiality breaches in the Kubernetes environment.

Recommendation

Immediately update Kamaji to version 26.7.4-edge or later, which contains the fix for the identifier collision issue.

Other vulnerabilities in Kamaji

CVE-2026-62845Medium
Kamaji, the Hosted Control Plane Manager for Kubernetes, prior to version 26.7.4-edge contains an SQL injection vulnerability in the PostgreSQL and MySQL datastore drivers. These drivers build DDL statements by interpolating user-supplied DataStoreUsername/DataStoreSchema fields without proper escaping, allowing SQL injection over Kamaji's root connection to the shared datastore. The etcd driver is not affected.

Original NVD description (English source)

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or destroy another tenant's Kubernetes data. This issue is fixed in version 26.7.4-edge.