EUVD-2026-51311Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attacker needs tenant-creation rights (PR:L) plus a usable normalized name collision and shared datastore (AC:H); the isolation break crosses tenants (S:C) with full C/I/A loss of the victim cluster.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or destroy another tenant's Kubernetes data. This issue is fixed in version 26.7.4-edge.
Articles & Coverage 1
AnalysisAI
Cross-tenant data compromise in Clastix Kamaji (Hosted Control Plane Manager for Kubernetes) before 26.7.4-edge lets one tenant read, modify, or destroy another tenant's control-plane state. Kamaji's defaulting webhook derived each TenantControlPlane's datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization that replaced dashes with underscores, so two tenants whose names normalize to the same string (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to create a TenantControlPlane resource (PR:L) whose namespace-and-name combination, after Kamaji's dash-to-underscore normalization in GetDefaultDatastoreSchema()/GetDefaultDatastoreUsername(), collides with a target tenant's normalized identifier - for example a tenant using a dash where another uses an underscore in the corresponding position. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 8.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H: network reachable, but high attack complexity and low privileges required, with a scope change reflecting that impact crosses the tenant isolation boundary into another tenant's data (full C/I/A loss of the victim cluster). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | In a multi-tenant Kamaji platform where customers self-select cluster names, an attacker provisions a TenantControlPlane whose namespace/name normalizes (dashes-to-underscores) to the same identifier as a victim tenant, causing Kamaji to assign both the same datastore schema, DB user, and etcd key prefix. The attacker's control plane then reads and writes the victim's shared etcd/kine state, letting it exfiltrate secrets, tamper with workloads, or wipe the victim cluster's data. … |
| Remediation | Vendor-released patch: 26.7.4-edge - upgrade Kamaji to 26.7.4-edge or later, which derives datastore schema and username from the immutable TenantControlPlane UID instead of the lossy namespace/name normalization (see GHSA-4f3f-65vx-r34f). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of Clastix Kamaji in production and determine their versions compared to the affected range (before version 26.7.4-edge); document any multi-tenant deployments that may share underlying storage. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Kamaji is the Hosted Control Plane Manager for Kubernetes. Rated critical severity (CVSS 9.9), this vulnerability is rem
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, ref
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today