What is the CVSS score of EUVD-2026-51311?

EUVD-2026-51311 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Kamaji are affected by EUVD-2026-51311?

Clastix Kamaji, a hosted control plane manager for Kubernetes, contains a tenant isolation bypass that enables unauthorized access to other organizations' cluster configurations in multi-tenant…. A patch is available.

How to fix or mitigate EUVD-2026-51311?

Within 24 hours, identify all instances of Clastix Kamaji in production and determine their versions compared to the affected range (before version 26.7.4-edge); document any multi-tenant deployments that may share underlying storage. Within 7 days, initiate a controlled upgrade to Kamaji version 26.7.4-edge or later, testing the schema migration process in a non-production environment to validate data integrity and tenant isolation enforcement. Complete the production upgrade to version 26.7.4-edge or later within 30 days, prioritizing multi-tenant deployments; conduct post-upgrade verification that cross-tenant access is properly blocked before returning to standard operations.

Kamaji EUVD-2026-51311

| CVE-2026-62246 HIGH

Improper Access Control (CWE-284)

2026-07-30 GitHub_M

Authentication Bypass Kubernetes Kamaji Clastix

8.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Attacker needs tenant-creation rights (PR:L) plus a usable normalized name collision and shared datastore (AC:H); the isolation break crosses tenants (S:C) with full C/I/A loss of the victim cluster.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 30, 2026 - 22:20 EUVD

Source Code Evidence Fetched

Jul 30, 2026 - 21:52 vuln.today

Analysis Generated

Jul 30, 2026 - 21:52 vuln.today

CVE Published

Jul 30, 2026 - 21:06 cve.org

HIGH 8.5

DescriptionCVE.org

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or destroy another tenant's Kubernetes data. This issue is fixed in version 26.7.4-edge.

Articles & Coverage 1

News 3 New Kubernetes Vulnerabilities - 3 High Severity Jul 31, 2026

AnalysisAI

Cross-tenant data compromise in Clastix Kamaji (Hosted Control Plane Manager for Kubernetes) before 26.7.4-edge lets one tenant read, modify, or destroy another tenant's control-plane state. Kamaji's defaulting webhook derived each TenantControlPlane's datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization that replaced dashes with underscores, so two tenants whose names normalize to the same string (e.g. 'a-b' vs 'a_b') were assigned identical datastore identifiers and silently shared backing storage. No public exploit identified at time of analysis and it is not in CISA KEV, but the root cause is confirmed by the vendor advisory (GHSA-4f3f-65vx-r34f) and the fixing commit, which now uses the immutable resource UID.

Technical ContextAI

Kamaji runs Kubernetes control planes as pods and stores each tenant cluster's etcd/kine state in a shared datastore (MySQL, PostgreSQL, or etcd), partitioned per tenant by a schema/database, a database user, and an etcd key prefix. Those identifiers were generated by GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername() via normalizeNamespaceName(), which built '<namespace>_<name>' and then ran strings.ReplaceAll(..., "-", "_") to satisfy PostgreSQL identifier rules (per Kamaji issue #328). This transformation is non-injective (lossy): distinct (namespace, name) pairs collapse to the same normalized string whenever they differ only in dash-vs-underscore, producing an identifier collision. The flaw maps to CWE-284 (Improper Access Control) - the tenant-isolation boundary is keyed on a value that is not guaranteed unique. The fix replaces the derivation with string(in.UID), the Kubernetes-assigned globally unique object UID, and additionally quotes generated identifiers in MySQL/PostgreSQL DDL (backticks and double-quotes). Affected CPE: cpe:2.3:a:clastix:kamaji:*.

RemediationAI

Vendor-released patch: 26.7.4-edge - upgrade Kamaji to 26.7.4-edge or later, which derives datastore schema and username from the immutable TenantControlPlane UID instead of the lossy namespace/name normalization (see GHSA-4f3f-65vx-r34f). Because the upgrade changes the identifier scheme, validate the vendor's migration guidance for existing tenants whose schemas/users were provisioned under the old naming before cutover. If immediate patching is not possible, enforce a tenant naming policy (e.g. via admission control) that removes dash/underscore ambiguity - disallow underscores in TenantControlPlane names/namespaces or require a unique suffix so no two normalized identifiers can collide; the trade-off is operational friction and that it does not retroactively fix already-collided tenants. Additionally restrict who can create TenantControlPlane resources and audit existing tenants for shared schemas/usernames both before and after upgrading. Advisory: https://github.com/clastix/kamaji/security/advisories/GHSA-4f3f-65vx-r34f.