Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| projectcapsule | capsule | 0.13.0 to before 0.13.7 | 0.13.7 | Patch available | CNA |
| — | github.com/projectcapsule/capsule (Go) | 0.13.0 to before 0.13.7 | 0.13.7 | Patch available | GHSA-gxjc-74v5-3vx3 |
- capsule Vendorprojectcapsule Affected 0.13.0 to before 0.13.7 Fixed in 0.13.7 Patch available CNA
- github.com/projectcapsule/capsule (Go) Vendor— Affected 0.13.0 to before 0.13.7 Fixed in 0.13.7 Patch available GHSA-gxjc-74v5-3vx3
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:projectcapsule:capsule:*:*:*:*:*:*:*:* | — | — | projectcapsule |
- cpe:2.3:a:projectcapsule:capsule:*:*:*:*:*:*:*:* Versions — — ·projectcapsule
Remediation
- Fix · CNA capsule (projectcapsule) Fixed in 0.13.7
- Fix · GHSA-gxjc-74v5-3vx3 github.com/projectcapsule/capsule (Go) Fixed in 0.13.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-61794
- 2026-10-03 Alias added: GHSA-gxjc-74v5-3vx3
References
Other 5
- https://github.com/projectcapsule/capsule/security/advisories/GHSA-gxjc-74v5-3vx3
- https://github.com/projectcapsule/capsule/pull/1983
- https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e
- https://github.com/projectcapsule/capsule/releases/tag/v0.13.7
- https://github.com/projectcapsule/capsule
More projectcapsule vulnerabilities
- TI-2024-26614 Capsule tenant owner with "patch namespace" permission can hijack system namespaces CVSS 3.1HIGH 8.8
- TI-2025-34881 Capsule tenant owners with "patch namespace" permission can hijack system namespaces label CVSS 3.1CRITICAL 9.1
- TI-2026-18364 Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability CVSS 4.0MEDIUM 6.9
- TI-2026-44157 Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement CVSS 3.1HIGH 7.1
- TI-2026-46911 Improper input validation in projectcapsule capsule CVSS 3.1MEDIUM 6.8
- TI-2026-46912 Improper privilege management in projectcapsule capsule CVSS 3.1MEDIUM 6.6
Sources
- CVE-2026-61794 · CVE Program
- CVE-2026-61794 · NVD
- FIRST EPSS
- GHSA-gxjc-74v5-3vx3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences