CVE-2026-62845

MediumCVSS 4.7

Published: 30/07/2026(UTC)Updated: 31/07/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

Kamaji, the Hosted Control Plane Manager for Kubernetes, prior to version 26.7.4-edge contains an SQL injection vulnerability in the PostgreSQL and MySQL datastore drivers. These drivers build DDL statements by interpolating user-supplied DataStoreUsername/DataStoreSchema fields without proper escaping, allowing SQL injection over Kamaji's root connection to the shared datastore. The etcd driver is not affected.

Risk Assessment

The organization risks unauthorized access to the Kamaji database, which could lead to modification of Kubernetes cluster configuration and potential cluster takeover.

Recommendation

Update Kamaji to version 26.7.4-edge or later, which includes a fix preventing SQL injection.

Other vulnerabilities in Kamaji

CVE-2026-62246High
In Kamaji, the Hosted Control Plane Manager for Kubernetes, prior to version 26.7.4-edge, the GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername() functions use lossy namespace-and-name normalization, causing identifier collisions. This allows distinct tenants to share control-plane state and read, modify, or destroy another tenant's Kubernetes data.

Original NVD description (English source)

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have no format validation, so a value containing a quote character breaks out of the quoted identifier — SQL injection executed over Kamaji's root connection to the shared datastore. etcd driver is not affected.This issue is fixed in version 26.7.4-edge.