CVE-2026-61672
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In Capsule prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When the forbidden list mixes capitalized and lowercase keys, the binary search can return false for a key that is present. An authenticated tenant owner can bypass configured namespace, Service, or delegated node metadata restrictions. This is fixed in version 0.13.7.
Risk Assessment
A tenant can bypass configured restrictions, influencing cluster policies, network exposure, or scheduling outside the tenant boundary. This can undermine multi-tenancy isolation.
Recommendation
Upgrade Capsule to version 0.13.7 or later. Ensure forbidden key lists are consistent in case.
Other vulnerabilities in Capsule
See all- CVE-2026-22872Critical
Vulnerability in Capsule, a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin privileges. TenantResource RawItems processing incorrectly handles cluster-scoped resources, allowing tenant administrators to create cluster-scoped resources (e.g., ClusterRole, ValidatingWebhookConfiguration) with elevated privileges, leading to cross-tenant privilege escalation and cluster-level attacks. Version 0.13.0 patches this issue.
- CVE-2026-61795Medium
Capsule from version 0.13.0 to 0.13.7 has a vulnerability in the Tenant validation webhook where the new and old parameters are reversed, causing validation of the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can store a malformed regex, which later blocks Ingress operations for the tenant. Fixed in version 0.13.7.
- CVE-2026-61794Medium
Capsule from version 0.13.0 to 0.13.7 has a vulnerability in Tenant update validation where ForbiddenLabels.Regex is compiled for both labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator can persist a malformed regex, which later causes regexp.MustCompile to panic during metadata validation and blocks namespace operations. Fixed in version 0.13.7.
- CVE-2026-55636Medium
Capsule from 0.13.0 to 0.13.6 has a vulnerability in the validating webhook configuration where namespace/finalize is used instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC can send a PUT request to /api/v1/namespaces/{namespace}/finalize, and the singular rule never matches the plural resource, so the validating webhook is not invoked and the user can change the namespace tenant label.
- CVE-2026-65835Medium
Capsule from 0.13.0 to 0.13.8 (after incomplete CVE-2026-22872 fix) did not apply cluster-scoped resource rejection guards, allowing a Tenant Owner to create cluster-scoped resources like ClusterRole or ValidatingWebhookConfiguration via the cluster-admin controller client.
- CVE-2026-65834Medium
Capsule before 0.13.8 did not validate regular expressions in CapsuleConfiguration for ForbiddenLabels and ForbiddenAnnotations. A Cluster Admin could store malformed regex that crashed the node admission webhook on node create, update, or patch requests.
- CVE-2026-30963Low
In Capsule for Kubernetes prior to 0.13.0, a vulnerability allowed namespace hijacking via namespace/finalize and namespace/status subresources. The validating webhook does not intercept these subresources, allowing a tenant admin to modify namespace metadata.
Original NVD description (English source)
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When an administrator's forbidden list mixes capitalized and lowercase keys or otherwise has different case-insensitive and byte ordering, the binary search can return false for a key that is present. An authenticated tenant owner can then pass the missed key through api.ValidateForbidden and bypass configured namespace, Service, or delegated node metadata restrictions, potentially influencing cluster policies, network exposure, or scheduling outside the tenant boundary. Uniformly lowercase lists whose two orderings coincide are not affected. This issue is fixed in version 0.13.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS