Read the docs
TI-2026-44925 Aliases CVE-2026-62845

Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers

Priority MEDIUM 55CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have no format validation, so a value containing a quote character breaks out of the quoted identifier — SQL injection executed over Kamaji's root connection to the shared datastore. etcd driver is not affected.This issue is fixed in version 26.7.4-edge.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00324 25th percentileScored 2026-11-07
Fix Fixed kamaji (clastix): 26.6.4-edge

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
clastixkamajibefore 26.6.4-edge26.6.4-edgePatch availableCNA
  • kamaji Vendorclastix Affected before 26.6.4-edge Fixed in 26.6.4-edge Patch available CNA

Remediation

  • Fix · CNA kamaji (clastix) Fixed in 26.6.4-edge

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-62845

References

Other 3

  • TI-2024-28448 Kamaji's RBAC Roles for `etcd` are not disjunct CVSS 3.1CRITICAL 9.9
  • TI-2022-07704 Privilege escalation using hop-by-hop Connection header CVSS 3.1HIGH 8.8
  • TI-2026-44467 Improper access control in clastix kamaji CVSS 3.1HIGH 8.5
  • TI-2023-26175 Authentication bypass using an empty token in capsule-proxy CVSS 3.1CRITICAL 9.8
  • TI-2022-22811 Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace CVSS 3.1HIGH 8.8
  • TI-2023-24881 Service accounts can see namespaces of other tenants in capsule-proxy CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences