CVE-2026-62246

Published: Jul 30, 2026Modified: Aug 1, 2026

8.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or destroy another tenant's Kubernetes data. This issue is fixed in version 26.7.4-edge.

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-653

Improper Isolation or Compartmentalization

The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

References (3)

https://github.com/clastix/kamaji/commit/4232a9df7ccd08075c26191f59566202042543a9

Source: security-advisories@github.com

https://github.com/clastix/kamaji/security/advisories/GHSA-4f3f-65vx-r34f

Source: security-advisories@github.com

https://github.com/clastix/kamaji/security/advisories/GHSA-4f3f-65vx-r34f

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.