Capsule CVE-2026-65834

Exploitation requires Cluster Admin RBAC privileges (or a ClusterRole with patch/update access to CapsuleConfiguration resources) to store the malformed regex. The crash is triggered only when the NodeMetadata regex feature is active - meaning Spec.NodeMetadata.ForbiddenLabels or Spec.NodeMetadata.ForbiddenAnnotations with a Regex sub-field must be populated in the CapsuleConfiguration. The Availability impact is gated on the Kubernetes API webhook failurePolicy: clusters using failurePolicy: Fail will block all node admission after the crash, while failurePolicy: Ignore will allow node operations to proceed with policy unenforced. Limiting factors include: (1) mandatory Cluster Admin or equivalent privilege to write CapsuleConfiguration; (2) the NodeMetadata regex feature must be in use rather than left at defaults; and (3) impact severity depends on the cluster's webhook failure policy configuration.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, score 6.8) accurately captures the principal constraint: Cluster Admin privileges (PR:H) are required, limiting the realistic attacker pool to insiders or compromised high-privilege accounts. The Scope:Changed (S:C) rating is significant - the panic in Capsule's webhook propagates to block all node admission operations across the cluster, meaning the operational blast radius far exceeds the vulnerable component alone. The Availability:High impact is genuine: in any cluster using a fail-closed webhook policy, no nodes can be added, updated, or patched until the misconfiguration is remediated. EPSS score is not provided in the available data. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, indicating no confirmed active exploitation. This is a moderate-priority issue in Capsule-managed clusters - the PR:H requirement lowers urgency for externally-facing threats, but the operational impact on node management and the insider/misconfiguration risk make patching advisable without delay.

An attacker with Cluster Admin credentials (or a malicious insider) patches the CapsuleConfiguration custom resource, setting Spec.NodeMetadata.ForbiddenLabels.Regex to a syntactically invalid Go regex such as '[invalid'. The next time any actor issues a kubectl label node or the cluster attempts to update a node object, Capsule's node admission webhook processes the configuration, calls regexp.MustCompile with the invalid pattern, panics, and crashes. On clusters with failurePolicy: Fail on the Capsule webhook, all subsequent Node create, update, and patch requests are rejected until the misconfiguration is corrected and the webhook restarted.