Kamaji CVE-2026-62845

Exploitation requires the ability to create or modify a Kamaji TenantControlPlane Kubernetes custom resource - typically a cluster-admin role or a custom RBAC role granting write access to TenantControlPlane objects in the kamaji-system namespace. The vulnerability triggers specifically when Kamaji processes the DataStoreUsername or DataStoreSchema fields of a TenantControlPlane resource using the PostgreSQL or MySQL datastore driver; etcd-backed deployments are not vulnerable regardless of RBAC. The pre-fix MySQL primary connection's multiStatements=true parameter is the escalating condition that permits stacked query injection; without it, injection would still break individual DDL statements but could not chain arbitrary SQL in a single call. Exploitation is bounded by the high-privilege prerequisite: unauthenticated users and low-privilege cluster members cannot supply these configuration values and are not able to trigger the vulnerability.

The CVSS 4.7 base score and PR:H vector accurately reflect the primary gatekeeping control: exploitation requires the ability to create or modify a TenantControlPlane Kubernetes custom resource, which is ordinarily restricted to cluster administrators or holders of a delegated RBAC role. This is a meaningful real-world constraint. However, the vendor CVSS impact ratings of C:L/I:L/A:L appear to understate the pre-fix MySQL exposure: the presence of multiStatements=true on the primary connection meant that successful identifier injection could escalate to arbitrary stacked SQL over a root-privileged connection shared across all tenant control planes - plausibly enabling full datastore read, data modification, or DROP operations. This raises the actual blast radius above what the base score suggests. EPSS was not provided in the source data; no KEV listing and no public POC exist, indicating no confirmed widespread exploitation. The combination of high-privilege prerequisite and niche deployment footprint keeps real-world exploitation probability low, but any environment where TenantControlPlane write access has been delegated broadly should treat this as higher priority than the base score implies.

A Kubernetes user holding cluster-admin or a delegated TenantControlPlane write role submits a TenantControlPlane resource with DataStoreUsername set to a value such as legit`; DROP DATABASE tenant_alpha;-- . Kamaji's MySQL driver interpolates this into a CREATE USER DDL statement via fmt.Sprintf without quoting, breaking out of the backtick identifier context. On pre-fix deployments where the primary MySQL connection carries multiStatements=true, the injected DROP DATABASE executes as a second stacked statement over the root datastore connection, destroying tenant_alpha's schema and taking down that tenant's Kubernetes control plane. No public POC has been identified.