Project Capsule CVE-2026-61795

Requires an actor with permission to update Tenant custom resources (effectively cluster-administrator level, per the description and PR:H) to submit a malformed AllowedHostnames.Regex on an *update* to an existing Tenant - the create path and the initial valid state are unaffected because the bug only mis-compares old vs new on OnUpdate. Impact is limited to tenants that use IngressOptions.AllowedHostnames.Regex; the resulting Ingress lockout persists only until an administrator repairs the Tenant configuration. Not exploitable by unprivileged tenant users or unauthenticated remote attackers, and only present in Capsule 0.13.0 through 0.13.6.

This is a genuine but LOW-priority defect, not a high-real-risk issue despite the 6.8 CVSS. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) confirms a pure availability impact (C:N/I:N) requiring high privileges (PR:H). Critically, the 'attacker' per the description is a *cluster administrator* - the actor who stores the malformed AllowedHostnames.Regex is already the most-privileged principal in the cluster, so the flaw is closer to a self-inflicted misconfiguration hazard than a cross-privilege attack. No EPSS score, no CISA KEV listing, and no public exploit code were provided: no public exploit identified at time of analysis. The S:C (scope-changed) claim is defensible in that the broken Tenant config later blocks Ingress operations for tenant users/namespaces distinct from the config author, but it is debatable. There are no conflicting signals in the data; the CVSS network vector is consistent with the Kubernetes webhook/API-server delivery path. CWE-697 (Incorrect Comparison) accurately maps to the reversed new/old parameter comparison.

A cluster administrator submits a Tenant update setting Spec.IngressOptions.AllowedHostnames.Regex to a malformed pattern (e.g. '('). Because hostnameRegexHandler.OnUpdate compares the stale previous value instead of the submitted one, the validating webhook accepts the update and persists the broken regex. Later, any tenant Ingress create/update evaluates the invalid pattern, silently treats every hostname as unmatched, and blocks all Ingress operations for that tenant until an admin manually repairs the Tenant. No public exploit code was provided.