CVE-2026-62845 Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers
Attackers can execute arbitrary SQL commands via unescaped identifiers in PostgreSQL or MySQL datastore drivers, compromising the shared datastore.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-62845?
CVE-2026-62845 is a medium-severity SQL injection vulnerability in clastix kamaji, published on 30 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have no format validation, so a value containing a quote character breaks out of the quoted identifier — SQL injection executed over Kamaji's root connection to the shared datastore. etcd driver is not affected.This issue is fixed in version 26.7.4-edge.
Weakness: CWE-89
Which versions are affected by CVE-2026-62845?
How do I fix CVE-2026-62845?
No fix has been published for CVE-2026-62845 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-62845 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62845 exists.
Sources
Also known as GHSA-r47v-ppwp-fh4r.