Executive brief
Kamaji is a tool used to manage Kubernetes control planes. A security flaw in its database drivers allows users with high-level permissions to inject malicious commands into the underlying database. If exploited, this could allow an attacker to gain unauthorized access to data belonging to other tenants or escalate their privileges within the shared database environment.
Technical details
A SQL injection vulnerability exists in Kamaji's PostgreSQL and MySQL datastore drivers prior to version 26.7.4-edge. The root cause is the direct interpolation of user-supplied 'DataStoreUsername' and 'DataStoreSchema' fields into DDL statements using 'fmt.Sprintf' without proper identifier escaping or format validation. An attacker with high privileges (sufficient to create or modify TenantControlPlane resources) can supply a crafted string containing quote characters to break out of the SQL identifier context. Because these statements are executed using Kamaji's root connection to a shared datastore, this can lead to cross-tenant data access or privilege escalation on the database server. The issue is fixed in version 26.7.4-edge by escaping identifiers and disabling multi-statement support on primary connections.
Affected products
- Clastix Kamaji < 26.7.4-edge
Timeline
- 2026-07-15: patched: Fix committed to repository
- 2026-07-15: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: CVE published to NVD