Clastix Kamaji up to 26.7.3-edge PostgreSQL/MySQL datastore drivers fmt.Sprintf DataStoreUsername/DataStoreSchema sql injection

Summaryinfo

A vulnerability identified as problematic has been detected in Clastix Kamaji up to 26.7.3-edge. This affects the function fmt.Sprintf of the component PostgreSQL/MySQL datastore drivers. The manipulation of the argument DataStoreUsername/DataStoreSchema leads to sql injection. This vulnerability is listed as CVE-2026-62845. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Clastix Kamaji up to 26.7.3-edge and classified as problematic. This issue affects the function fmt.Sprintf of the component PostgreSQL/MySQL datastore drivers. The manipulation of the argument DataStoreUsername/DataStoreSchema with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have no format validation, so a value containing a quote character breaks out of the quoted identifier — SQL injection executed over Kamaji's root connection to the shared datastore. etcd driver is not affected.This issue is fixed in version 26.7.4-edge.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-62845 since 07/14/2026. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1505 for this issue.

Upgrading to version 26.7.4-edge eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Clastix

Name

• Kamaji

Version

• 26.7.3-edge

Website

• Product: https://github.com/clastix/kamaji/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion