PT-2026-60574 · Clastix · Kamaji

CVE-2026-62246 · Published 2026-07-16 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kamaji versions prior to 26.7.4-edge

Description Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization process within the GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername() functions. This allows distinct tenants with colliding normalized identifiers to share control-plane state, enabling them to read, modify, or destroy Kubernetes data belonging to another tenant.

Recommendations Update to version 26.7.4-edge.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-653

Related Identifiers

CVE-2026-62246

Affected Products

Kamaji

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-62246 · Security Note
• https://github.com/clastix/kamaji/commit/4232a9df7ccd08075c26191f59566202042543a9 · Note
• https://github.com/clastix/kamaji/security/advisories/GHSA-4f3f-65vx-r34f · Note
• https://twitter.com/clastixio/status/2077779972127691064 · Twitter Post