CVE-2026-62845
Received Received - Intake

SQL Injection in Kamaji Hosted Control Plane

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description
Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have no format validation, so a value containing a quote character breaks out of the quoted identifier — SQL injection executed over Kamaji's root connection to the shared datastore. etcd driver is not affected.This issue is fixed in version 26.7.4-edge.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-62845

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
kamaji hosted_control_plane_manager to 26.7.4-edge (inc)
postgresql postgresql *
mysql mysql *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kamaji is a Hosted Control Plane Manager for Kubernetes. Prior to version 26.7.4-edge, it had a flaw where PostgreSQL and MySQL datastore drivers built SQL statements by directly inserting user-supplied values like DataStoreUsername and DataStoreSchema without proper escaping. This allowed SQL injection attacks if those values contained quote characters, potentially compromising the shared datastore.

Detection Guidance

Detecting this vulnerability requires checking the Kamaji version and inspecting datastore configurations for unsafe username or schema values. Verify if the installed version is below 26.7.4-edge. Inspect PostgreSQL and MySQL datastore configurations for DataStoreUsername or DataStoreSchema fields containing special characters like quotes.

Impact Analysis

If you use Kamaji with PostgreSQL or MySQL datastores before version 26.7.4-edge, an attacker could exploit this to execute unauthorized SQL commands. This might lead to data theft, manipulation, or deletion in the shared datastore. The impact depends on the permissions of Kamaji's root connection to the datastore.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Compliance may be compromised if data breaches occur due to this flaw.

Mitigation Strategies

Upgrade Kamaji to version 26.7.4-edge or later immediately. Review and sanitize DataStoreUsername and DataStoreSchema values in datastore configurations to prevent SQL injection. Restrict access to Kamaji administrative interfaces and monitor datastore logs for suspicious queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62845. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart