Clastix vulnerabilities

Products

• Capsule 3
• Capsule-proxy 3
• Kamaji 3

Newest

• clastix kamaji Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers CVE-2026-62845 4.7 MediumJuly 30, 2026
• clastix kamaji Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolation CVE-2026-62246 8.5 HighJuly 30, 2026
• clastix capsule Capsule tenant owner with "patch namespace" permission can hijack system namespaces CVE-2024-39690 Fix available 8.5 HighAugust 20, 2024
• clastix kamaji Kamaji's RBAC Roles for `etcd` are not disjunct CVE-2024-42480 8.1 HighAugust 12, 2024
• clastix capsule-proxy Authentication bypass using an empty token in capsule-proxy CVE-2023-48312 Fix available 9.8 CriticalNovember 24, 2023
• clastix capsule, capsule-proxy +1 more Service accounts can see namespaces of other tenants in capsule-proxy CVE-2023-46254 Fix available 4.3 MediumNovember 6, 2023
• clastix capsule Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace CVE-2022-46167 Fix available 8.8 HighDecember 2, 2022
• clastix capsule-proxy Privilege escalation using hop-by-hop Connection header CVE-2022-23652 Fix available 8.8 HighFebruary 22, 2022