CVE-2026-62845

Name of the Vulnerable Software and Affected Versions Kamaji versions prior to 26.7.4-edge

Description The PostgreSQL and MySQL datastore drivers build Data Definition Language (DDL) statements by interpolating user-supplied DataStoreUsername and DataStoreSchema directly into SQL using fmt.Sprintf without escaping identifiers. Due to a lack of format validation, a value containing a quote character allows an attacker to break out of the quoted identifier, leading to SQL injection executed via the root connection to the shared datastore. DDL is a set of SQL commands used to define the database structure.

Recommendations Update to version 26.7.4-edge.