CVE-2026-61794
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Capsule from version 0.13.0 to 0.13.7 has a vulnerability in Tenant update validation where ForbiddenLabels.Regex is compiled for both labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator can persist a malformed regex, which later causes regexp.MustCompile to panic during metadata validation and blocks namespace operations. Fixed in version 0.13.7.
Risk Assessment
A malformed regex can lead to a panic and blocking namespace operations, potentially disrupting the entire tenant.
Recommendation
Update Capsule to version 0.13.7 or later. Review and fix existing Tenant configurations.
Other vulnerabilities in Capsule
See all- CVE-2026-22872Critical
Vulnerability in Capsule, a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin privileges. TenantResource RawItems processing incorrectly handles cluster-scoped resources, allowing tenant administrators to create cluster-scoped resources (e.g., ClusterRole, ValidatingWebhookConfiguration) with elevated privileges, leading to cross-tenant privilege escalation and cluster-level attacks. Version 0.13.0 patches this issue.
- CVE-2026-61795Medium
Capsule from version 0.13.0 to 0.13.7 has a vulnerability in the Tenant validation webhook where the new and old parameters are reversed, causing validation of the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can store a malformed regex, which later blocks Ingress operations for the tenant. Fixed in version 0.13.7.
- CVE-2026-61672High
In Capsule prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When the forbidden list mixes capitalized and lowercase keys, the binary search can return false for a key that is present. An authenticated tenant owner can bypass configured namespace, Service, or delegated node metadata restrictions. This is fixed in version 0.13.7.
- CVE-2026-55636Medium
Capsule from 0.13.0 to 0.13.6 has a vulnerability in the validating webhook configuration where namespace/finalize is used instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC can send a PUT request to /api/v1/namespaces/{namespace}/finalize, and the singular rule never matches the plural resource, so the validating webhook is not invoked and the user can change the namespace tenant label.
- CVE-2026-65835Medium
Capsule from 0.13.0 to 0.13.8 (after incomplete CVE-2026-22872 fix) did not apply cluster-scoped resource rejection guards, allowing a Tenant Owner to create cluster-scoped resources like ClusterRole or ValidatingWebhookConfiguration via the cluster-admin controller client.
- CVE-2026-65834Medium
Capsule before 0.13.8 did not validate regular expressions in CapsuleConfiguration for ForbiddenLabels and ForbiddenAnnotations. A Cluster Admin could store malformed regex that crashed the node admission webhook on node create, update, or patch requests.
- CVE-2026-30963Low
In Capsule for Kubernetes prior to 0.13.0, a vulnerability allowed namespace hijacking via namespace/finalize and namespace/status subresources. The validating webhook does not intercept these subresources, allowing a tenant admin to modify namespace metadata.
Original NVD description (English source)
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS