CVE-2026-62845mediumCWE-89

CVE-2026-62845: falha de média gravidade em clastix kamaji

Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar kamaji

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.7epss 0.3%
Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have no format validation, so a value containing a quote character breaks out of the quoted identifier — SQL injection executed over Kamaji's root connection to the shared datastore. etcd driver is not affected.This issue is fixed in version 26.7.4-edge.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
clastix · kamaji
CVEs relacionadas — clastix kamaji

No mesmo produto, das mais perigosas para as menos.

CVE-2024-42480HIGHKamaji's RBAC Roles for `etcd` are not disjunctEPSS 0.6%CVE-2026-62246HIGHKamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolationEPSS 0.4%