CyberRota Analysis
AI-GeneratedKamaji, the Hosted Control Plane Manager for Kubernetes, is vulnerable due to a flaw in how it normalizes tenant identifiers, which can lead to distinct tenants inadvertently sharing control-plane state. This vulnerability allows attackers to read, modify, or destroy another tenant's Kubernetes data, posing a significant risk to multi-tenant environments. Organizations using Kamaji versions prior to 26.7.4-edge should prioritize upgrading to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or destroy another tenant's Kubernetes data. This issue is fixed in version 26.7.4-edge.