CVE-2026-62246

Executive Summary

CVE-2026-62246 exposes a critical tenant isolation flaw in Kamaji, the Hosted Control Plane Manager for Kubernetes. Prior to version 26.7.4-edge, the normalization of namespace and name identifiers used for datastore schema, database user, and etcd key prefix is lossy, meaning distinct tenants can generate colliding normalized strings. This enables one tenant to inadvertently share control-plane state with another, leading to potential read, modification, or destruction of Kubernetes data belonging to a different tenant. The vulnerability has a CVSS score of 8.5 (High) and currently no public PoC or exploit code is available. Immediate upgrade to the patched version is required.

Supply Chain & Package Security

Kamaji is a Go-based open source component for managing Kubernetes control planes. As such, the vulnerability resides in the Go source code repository. Teams deploying Kamaji via Go modules or container images should verify their dependency graph is pinned to the patched version. No malicious packages or compromised artifacts have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• Base Score: 8.5 (High)
• Vector: (Not officially published; estimated based on description)
• Attack Vector: Network (exploitable from adjacent tenant environments)
• Attack Complexity: Low (simple normalization collision)
• Privileges Required: Low (attacker must be a legitimate tenant)
• User Interaction: None
• Scope: Changed (impacts other tenants' control-plane data)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• EPSS Score: 0.0% (low probability of exploitation in the wild as of reporting)

Deep Dive & Mechanics

The core issue lies in the functions GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername() within Kamaji's tenant provisioning logic. These functions derive a unique datastore schema name, database user, and etcd key prefix from a combination of the TenantControlPlane's namespace and name. The normalization process uses a lossy transformation (e.g., truncation, case-folding, or character replacement) that can cause different tenant identifiers to map to the same normalized output.

For example, tenant namespace-a/control-plane-xyz and tenant namespace-A/control-plane-XYZ might both normalize to nsacontrolplanexyz after lowercasing and removing hyphens, and then be truncated to a fixed length. If the truncation produces identical strings, both tenants would share:

• The same PostgreSQL schema or MySQL database, allowing cross-tenant SQL operations.
• The same etcd key prefix, leaking or corrupting Kubernetes resource state.
• The same database user, enabling privilege escalation.

Consequently, an attacker controlling one tenant can:

1. Read another tenant's secrets, ConfigMaps, or workload definitions.
2. Modify or delete control-plane resources.
3. Cause denial of service by corrupting shared state.

The vulnerability is only exploitable if an attacker can register a new tenant with a crafted namespace/name that collides with an existing or future victim tenant. In multi-tenant Kamaji deployments, this is a realistic threat.

Vulnerable vs. Patched Code

The patched version (26.7.4-edge) introduces a more robust normalization that includes a hash or salt to guarantee uniqueness. While the exact code changes are not publicly disclosed, the fix likely replaces the deterministic, lossy transform with a combination like:

// Vulnerable (pre-26.7.4-edge)
func GetDefaultDatastoreSchema(namespace, name string) string {
    normalized := strings.ToLower(namespace + "-" + name)
    // remove special chars
    normalized = strings.ReplaceAll(normalized, "-", "")
    // truncate to 20 chars
    return normalized[:20]
}

// Patched (26.7.4-edge)
func GetDefaultDatastoreSchema(namespace, name string) string {
    // Use a collision-resistant hash
    hash := sha256.Sum256([]byte(namespace + "/" + name))
    return fmt.Sprintf("kcp_%x", hash[:10])
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Kamaji management cluster as a tenant.
• Ability to create TenantControlPlane resources with custom namespace/name.

Steps:

1. Identify the normalization logic (reverse engineer from source or observe existing patterns).
2. Determine the set of existing or predictable tenant namespace/name pairs.
3. Craft a new TenantControlPlane with a namespace/name that normalizes to the same string as a victim tenant.
4. After creation, access the shared datastore or etcd key space.
5. Use standard Kubernetes API calls or direct database queries to exfiltrate or corrupt victim data.

PoC Snippet (illustrative, no public exploit):

# Example collision generation
import hashlib

def normalize_buggy(ns, name):
    combined = (ns + name).lower().replace("-", "")
    return combined[:20]

target_ns = "production"
target_name = "team-alpha"
target_norm = normalize_buggy(target_ns, target_name)

# Find a colliding tenant
for i in range(1000):
    guess_ns = f"tenant-{i}"
    guess_name = f"control-{i}"
    if normalize_buggy(guess_ns, guess_name) == target_norm:
        print(f"Collision found: {guess_ns}/{guess_name}")
        break

Blue Team

Detection:

• Monitor logs for creation of TenantControlPlane resources with unusually short or repetitive normalized identifiers.
• Alert on any cross-tenant access patterns in etcd or database audit logs.
• Enable admission controllers (e.g., Kyverno) to reject tenant names that match existing normalized identifiers.

Hunting Query (pseudo-log):

log_type: kamaji
event: tenant_create
normalized_schema: (select normalized_schema from kamaji_tenants group by normalized_schema having count(*) > 1)

Indicators of Compromise (IOCs)

• Unique normalized schema names that appear more than once in the datastore metadata (e.g., SELECT schema_name FROM information_schema.schemata WHERE schema_name LIKE 'kcp_%' GROUP BY schema_name HAVING COUNT(*) > 1).
• Unexpected etcd key prefixes shared across tenants (visible via etcdctl).
• Database user collisions (multiple tenants mapped to the same PostgreSQL role).
• Abnormal API calls to read resources belonging to other tenants.
• Log messages indicating schema/user creation conflicts.

Detection Engineering

YARA Rule

rule CVE_2026_62246_Kamaji_TenantCollision
{
    meta:
        description = "Detect vulnerable Kamaji source code containing lossy normalization for datastore schema and user"
        author = "Valters IT"
        date = "2026-01-25"
        reference = "CVE-2026-62246"

    strings:
        $func_schema = "GetDefaultDatastoreSchema" ascii wide nocase
        $func_user = "GetDefaultDatastoreUsername" ascii wide nocase
        $lossy_op = ["ToLower", "ReplaceAll", "strings.Trim", "Truncate"] ascii wide

    condition:
        all of ($func_schema, $func_user) and 1 of ($lossy_op)
}

Sigma Rule

title: CVE-2026-62246 - Kamaji Tenant Collision Detection
status: experimental
description: Detects creation of TenantControlPlane resources that may collide normalized identifiers
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        verb: create
        objectRef.resource: tenantcontrolplanes
        objectRef.namespace: "*"
    condition: selection
    timeframe: 10m
fields:
    - user.username
    - objectRef.name
falsepositives:
    - Legitimate tenants with identical normalized names after fix
level: high

Suricata Rule

alert tcp $HOME_NET any -> $KAMAJI_MGMT 6443 (msg:"CVE-2026-62246 - Potential TenantCollision Create"; flow:to_server; content:"/apis/kamaji.clastix.io/v1alpha1/namespaces/"; fast_pattern; content:"tenantcontrolplanes"; within:200; pcre:"/normalizedSchema/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade all Kamaji instances to 26.7.4-edge or later.
2. Audit existing tenants for any pre-existing collisions. Compare all TenantControlPlane namespace/name combinations for normalized duplicates.
3. Restrict tenant creation to trusted users until the patch is applied.

Long-Term Measures:

• Implement a naming convention that includes a random suffix to reduce collision probability.
• Enable admission webhooks to validate that the normalized identifier does not conflict with existing ones.
• Monitor the Kamaji GitHub repository for future security advisories.

Vendor Contact: The Kamaji team is aware of the issue and has released a fix. No CVE-specific workarounds other than upgrading are recommended.

Valters IT - 2026 - Threat Intelligence Report for CVE-2026-62246