Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-62246: Kamaji is the Hosted Control Plane Manager for Kubernetes

45
This month
HIGH 8.5WATCHLIST

CVE-2026-62246 is a high-severity flaw (CVSS 8.5) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or destroy another tenant's Kubernetes data. This issue i

Why this priority

  • High severity
  • CISA SSVC: public proof of concept
  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score8.5 (High)
Attack vectorNetwork (remote)
Attack complexityHigh
Privileges neededLow
User interactionNone
EPSS exploit chance0.4% (top 71%)
CISA exploited listNo
WeaknessCWE-284, CWE-653
Published2026-07-30
Last modified2026-10-23
Publisher (CNA): GitHub, Inc.

Timeline

Exact fixes by distribution

Fedora 46 · kwin-zones · FIXED · 1.0.13-1.fc46 · FEDORA-2026-95888f332b · source
sudo dnf upgrade --advisory=FEDORA-2026-95888f332b
Fedora ELN · nginx-mod-brotli · FIXED · 1.0.0~rc-16.eln159 · FEDORA-2026-501a6a8273 · source
sudo dnf upgrade --advisory=FEDORA-2026-501a6a8273

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

References

← Back to latest CVEs