CVE-2026-62845

What it is

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have no format validation, so a value containing a quote character breaks out of the quoted identifier — SQL injection executed over Kamaji's root connection to the shared datastore. etcd driver is not affected.This issue is fixed in version 26.7.4-edge.

At a glance

Exploitability

Can be exploited over the network with an admin-level account. Limited direct impact.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-07-30 22:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-23 22:10 UTC Last updatedMost recent change to the record

Details

Published

2026-07-30 22:16 UTC

Last modified

2026-10-23 22:10 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-89 · SQL injection

Record status

Deferred

Attack profile CVSS 3.1 · 4.7

Attack vector

Network

Complexity

Low

Privileges needed

High

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low