Incorrect comparison in projectcapsule capsule
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| projectcapsule | capsule | 0.13.0 to before 0.13.7 | 0.13.7 | Patch available | CNA |
| — | github.com/projectcapsule/capsule (Go) | 0.13.0 to before 0.13.7 | 0.13.7 | Patch available | GHSA-f94q-w3w8-cj67 |
- capsule Vendorprojectcapsule Affected 0.13.0 to before 0.13.7 Fixed in 0.13.7 Patch available CNA
- github.com/projectcapsule/capsule (Go) Vendor— Affected 0.13.0 to before 0.13.7 Fixed in 0.13.7 Patch available GHSA-f94q-w3w8-cj67
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:projectcapsule:capsule:*:*:*:*:*:*:*:* | — | — | projectcapsule |
- cpe:2.3:a:projectcapsule:capsule:*:*:*:*:*:*:*:* Versions — — ·projectcapsule
Remediation
- Fix · CNA capsule (projectcapsule) Fixed in 0.13.7
- Fix · GHSA-f94q-w3w8-cj67 github.com/projectcapsule/capsule (Go) Fixed in 0.13.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-61795
- 2026-10-03 Alias added: GHSA-f94q-w3w8-cj67
References
Other 5
- https://github.com/projectcapsule/capsule/security/advisories/GHSA-f94q-w3w8-cj67
- https://github.com/projectcapsule/capsule/pull/1983
- https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e
- https://github.com/projectcapsule/capsule/releases/tag/v0.13.7
- https://github.com/projectcapsule/capsule
More projectcapsule vulnerabilities
- TI-2024-26614 Capsule tenant owner with "patch namespace" permission can hijack system namespaces CVSS 3.1HIGH 8.8
- TI-2025-34881 Capsule tenant owners with "patch namespace" permission can hijack system namespaces label CVSS 3.1CRITICAL 9.1
- TI-2026-18364 Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability CVSS 4.0MEDIUM 6.9
- TI-2026-44157 Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement CVSS 3.1HIGH 7.1
- TI-2026-46911 Improper input validation in projectcapsule capsule CVSS 3.1MEDIUM 6.8
- TI-2026-44232 Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic CVSS 3.1MEDIUM 6.8
Sources
- CVE-2026-61795 · CVE Program
- CVE-2026-61795 · NVD
- FIRST EPSS
- GHSA-f94q-w3w8-cj67 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences