A high severity vulnerability in the Clastix Kamaji control plane manager allows authenticated attackers to bypass access controls and compromise the integrity of the managed Kubernetes environment.

This vulnerability consists of improper access control and improper isolation or compartmentalization (CWE-284, CWE-653). It requires an attacker to have low-level privileges (PR:L) to exploit the flaw, potentially resulting in complete compromise of the control plane.

Successful exploitation poses a significant risk to the security of Kubernetes clusters managed by Kamaji. An attacker could gain unauthorized control over managed clusters, leading to data exfiltration, service disruption, or total system compromise. With a CVSS score of 8.5, this vulnerability is categorized as high severity and demands immediate attention to maintain the confidentiality and integrity of hosted control planes.

Immediate Action: Update all Kamaji instances to version 26.7.4-edge or later to implement the vendor-provided security fixes.

Proactive Monitoring: Audit Kubernetes audit logs for suspicious API requests or unauthorized attempts to access control plane resources by authenticated users.

Compensating Controls: Implement strict Network Policies and RBAC restrictions to limit the exposure of the Kamaji API to authorized internal entities only.

Public Exploit Available: false

Given the critical nature of control plane management software, organizations using Kamaji should treat this update as high priority. Administrators must verify their current version and apply the patch to prevent potential lateral movement or privilege escalation within their Kubernetes infrastructure.