Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers
Published Jul 30, 2026
4.7
MEDIUMCVSS 3.1
EPSS 0.32%
Description
Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have no format validation, so a value containing a quote character breaks out of the quoted identifier — SQL injection executed over Kamaji's root connection to the shared datastore. etcd driver is not affected.This issue is fixed in version 26.7.4-edge.
Affected products
-
Affected
- < 26.6.4-edge
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (4)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51312 Advisory
- https://github.com/clastix/kamaji/commit/6a9f3e10ae408e7948e2aca2db694791a299e79c x_refsource_MISC
- https://github.com/clastix/kamaji/releases/tag/26.7.4-edge x_refsource_MISC
- https://github.com/clastix/kamaji/security/advisories/GHSA-r47v-ppwp-fh4r exploitx_refsource_CONFIRM
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51312 | Advisory | |
| https://github.com/clastix/kamaji/commit/6a9f3e10ae408e7948e2aca2db694791a299e79c | x_refsource_MISC | |
| https://github.com/clastix/kamaji/releases/tag/26.7.4-edge | x_refsource_MISC | |
| https://github.com/clastix/kamaji/security/advisories/GHSA-r47v-ppwp-fh4r | exploitx_refsource_CONFIRM |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data