Kamaji constructs database schema definitions by interpolating the user‑supplied DataStoreUsername and DataStoreSchema identifiers directly into DDL statements without escaping or validating them. This omission allows an attacker who can supply a value containing a quote character to break out of the quoted identifier and inject arbitrary SQL. The injection is executed using Kamaji’s root connection to the shared PostgreSQL or MySQL datastore, giving the attacker the ability to read, modify, or delete any data in the cluster’s data store, potentially compromising the confidentiality, integrity, and availability of the entire Kubernetes environment.

All releases of clastix Kamaji before 26.7.4-edge that use the PostgreSQL or MySQL datastore drivers are vulnerable. The etcd driver is not affected. Users running versions prior to 26.7.4-edge on any topology that relies on a shared PostgreSQL or MySQL backend are impacted.

The CVSS score of 4.7 indicates moderate severity, and the EPSS score is <1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious DataStoreUsername or DataStoreSchema value, so the attack vector is likely through an API or configuration interface that accepts these fields. If such an interface is exposed, the attacker could gain unrestricted database access until the patch is applied.