clastix vulnerabilities

Products

• github.com/clastix/capsule 3
• github.com/clastix/capsule-proxy 3
• github.com/clastix/kamaji 3

Latest clastix CVEs

Newest publication first

1. CVE-2026-62845 Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers

   Published 2026-07-30

   Medium·CVSS 4.7 EPSS 0.32%

   Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. T...

2. CVE-2026-62246 Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolation

   Published 2026-07-30

   High·CVSS 8.5 EPSS 0.36%

   Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername()...

3. CVE-2024-39690 Capsule tenant owner with "patch namespace" permission can hijack system namespaces

   Published 2024-08-20

   High·CVSS 8.8 EPSS 0.54%

   Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant (i.e., namespaces without the ownerReference field), thereby gaining control of that na...

4. CVE-2024-42480 Kamaji's RBAC Roles for `etcd` are not disjunct

   Published 2024-08-12

   Critical·CVSS 9.9 EPSS 0.62%

   Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnera...

5. CVE-2023-48312 Authentication bypass using an empty token in capsule-proxy

   Published 2023-11-24

   Critical·CVSS 9.8 EPSS 0.57%

   capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a missing check if the user is authenticated based on the TokenReview result. All the clusters running with the anonymous-aut...

6. CVE-2023-46254 Service accounts can see namespaces of other tenants in capsule-proxy

   Published 2023-11-06

   Medium·CVSS 4.3 EPSS 0.50%

   capsule-proxy is a reverse proxy for Capsule kubernetes multi-tenancy framework. A bug in the RoleBinding reflector used by capsule-proxy gives ServiceAccount tenant owners the right to list Namespaces of other tenants backed by the same owner kind and name. For example consider...

7. CVE-2022-46167 Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace

   Published 2022-12-02

   High·CVSS 8.8 EPSS 0.96%

   Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted with PATCH capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation...

8. CVE-2022-23652 Privilege escalation using hop-by-hop Connection header

   Published 2022-02-22

   High·CVSS 8.8 EPSS 1.4%

   capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious Connection header to start a privilege escalation attack towards the Kubernetes API...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.