Read the docs
TI-2026-44467 Aliases CVE-2026-62246

Improper access control in clastix kamaji

Priority HIGH 72CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or destroy another tenant's Kubernetes data. This issue is fixed in version 26.7.4-edge.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00363 30th percentileScored 2026-11-07
Fix Fixed kamaji (clastix): 26.7.4-edge

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
clastixkamajibefore 26.7.4-edge26.7.4-edgePatch availableCNA
  • kamaji Vendorclastix Affected before 26.7.4-edge Fixed in 26.7.4-edge Patch available CNA

Remediation

  • Fix · CNA kamaji (clastix) Fixed in 26.7.4-edge

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-62246

References

Other 2

  • TI-2024-28448 Kamaji's RBAC Roles for `etcd` are not disjunct CVSS 3.1CRITICAL 9.9
  • TI-2022-07704 Privilege escalation using hop-by-hop Connection header CVSS 3.1HIGH 8.8
  • TI-2026-44925 Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers CVSS 3.1MEDIUM 4.7
  • TI-2023-26175 Authentication bypass using an empty token in capsule-proxy CVSS 3.1CRITICAL 9.8
  • TI-2022-22811 Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace CVSS 3.1HIGH 8.8
  • TI-2023-24881 Service accounts can see namespaces of other tenants in capsule-proxy CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences