CVE-2024-42480highCWE-284

CVE-2024-42480: high-severity vulnerability in clastix kamaji

Kamaji's RBAC Roles for `etcd` are not disjunct

Published

Follow this CVE+ Monitor kamaji+ Monitor github.com/clastix/kamaji

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.6%
Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed in edge-24.8.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
clastix · kamaji
Related CVEs — clastix kamaji

In the same product, most dangerous first.

CVE-2026-62246HIGHKamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolationEPSS 0.4%CVE-2026-62845MEDIUMKamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL driversEPSS 0.3%