CyberRota Analysis
AI-GeneratedKubernetes users utilizing the Kamaji Hosted Control Plane Manager should prioritize upgrading to version 26.7.4-edge due to a vulnerability in the PostgreSQL and MySQL datastore drivers that allows for SQL injection through unescaped user-supplied identifiers. This flaw can lead to unauthorized access or manipulation of the shared datastore, posing a significant risk to data integrity and security. Organizations relying on these database drivers should assess their exposure and implement the necessary updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have no format validation, so a value containing a quote character breaks out of the quoted identifier — SQL injection executed over Kamaji's root connection to the shared datastore. etcd driver is not affected.This issue is fixed in version 26.7.4-edge.