What’s Vulnerable › Vulnerabilities

CVE-2026-62845: Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-30 · updated 2026-10-23
• Weakness: CWE-89

Description

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have no format validation, so a value containing a quote character breaks out of the quoted identifier — SQL injection executed over Kamaji's root connection to the shared datastore. etcd driver is not affected.This issue is fixed in version 26.7.4-edge.

Affected products

• clastix kamaji: before 26.6.4-edge

References

• https://github.com/clastix/kamaji/commit/6a9f3e10ae408e7948e2aca2db694791a299e79c
• https://github.com/clastix/kamaji/releases/tag/26.7.4-edge
• https://github.com/clastix/kamaji/security/advisories/GHSA-r47v-ppwp-fh4r
• https://github.com/clastix/kamaji/security/advisories/GHSA-r47v-ppwp-fh4r

Get alerted when CVE-2026-62845 or the next vulnerability affects your stack