What is CVE-2026-62845?
CVE-2026-62845 affects Kamaji (Kubernetes Hosted Control Plane Manager) versions prior to 26.7.4-edge, where PostgreSQL and MySQL datastore drivers suffer from SQL injection. The vulnerability arises from the unsafe interpolation of user-supplied DataStoreUsername/DataStoreSchema values directly into SQL statements via fmt.Sprintf. Users should upgrade to version 26.7.4-edge or later to mitigate this issue.
Related CVEs
link basis: same weakness class CWE-89
FAQ2
In which component of Kamaji does CVE-2026-62845 exist?
CVE-2026-62845 exists in the PostgreSQL and MySQL datastore drivers of Kamaji, where user-supplied DataStoreUsername/DataStoreSchema values are interpolated directly into SQL statements, leading to SQL injection.
To which version should Kamaji be upgraded to mitigate CVE-2026-62845?
To mitigate CVE-2026-62845, Kamaji should be upgraded to version 26.7.4-edge or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.