What is CVE-2026-62246?

CVE-2026-62246 is a high-severity vulnerability in Clastix Kamaji, classified under Improper Access Control. CVSS score: 8.5/10. Published 2026-07-30.

How severe is CVE-2026-62246?

High severity. CVSS v3 base score is 8.5 out of 10.

Vulnerability in Clastix Kamaji

CVE-2026-62246

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or destroy another tenant's Kubernetes data. This issue is fixed in version 26.7.4-edge.

EPSS: 0.003 (19.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Clastix Kamaji — versions < 26.7.4-edge

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-62246?: CVE-2026-62246 is a high-severity vulnerability in Clastix Kamaji, classified under Improper Access Control. CVSS score: 8.5/10. Published 2026-07-30.
How severe is CVE-2026-62246?: High severity. CVSS v3 base score is 8.5 out of 10.