SQL Injection Vulnerability in Kamaji Hosted Control Plane for Kubernetes
CVE-2026-62845

4.7MEDIUM

Key Information:

Vendor

Clastix

Status
Kamaji
Vendor
CVE Published:
30 July 2026

What is CVE-2026-62845?

Kamaji, a Hosted Control Plane Manager for Kubernetes, had a vulnerability where PostgreSQL and MySQL datastore drivers incorrectly handled user-supplied identifiers. The lack of proper escaping and format validation led to an SQL injection risk, allowing attackers to execute unauthorized SQL commands through the application's root connection to the shared datastore. This vulnerability has been addressed in version 26.7.4-edge, which provides the necessary fixes to enhance the security against such attacks.

Affected Version(s)

kamaji < 26.6.4-edge

References

https://github.com/clastix/kamaji/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/clastix/kamaji/commit/6a9f3e10ae408e79...
x_refsource_MISC
https://github.com/clastix/kamaji/releases/tag/26.7.4-edge
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.