EUVD-2026-51295
GHSA-68cj-mvg9-rgm2
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Cluster Admin privileges required to write CapsuleConfiguration (PR:H); webhook crash propagates to all node admission cluster-wide (S:C); no confidentiality or integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster Admin to store a malformed regex that later reached regexp.MustCompile in pkg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and crashed the node admission webhook on Node create, update, or patch requests. This issue is fixed in version 0.13.8.
AnalysisAI
Capsule's node admission webhook can be crashed cluster-wide by a Cluster Admin who stores a malformed regular expression in CapsuleConfiguration's NodeMetadata fields, causing a Go panic via regexp.MustCompile that blocks all subsequent Node create, update, and patch operations. All Capsule versions prior to 0.13.8 are affected, as confirmed by GitHub Security Advisory GHSA-68cj-mvg9-rgm2. No public exploit has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that the crash cascades beyond the vulnerable Capsule component to impair node admission cluster-wide.
Technical ContextAI
Capsule is a Kubernetes operator implementing multi-tenancy and policy enforcement via admission webhooks. The root cause (CWE-20, Improper Input Validation) lies in CapsuleConfiguration custom resource fields - specifically Spec.NodeMetadata.ForbiddenLabels.Regex and Spec.NodeMetadata.ForbiddenAnnotations.Regex - which accept Go regular expressions to restrict node metadata changes. These fields were stored by the Kubernetes API without validation by the CapsuleConfiguration admission webhook. When a Node create, update, or patch request subsequently arrives, the node admission webhook in internal/webhook/node/user_metadata.go invokes regexp.MustCompile (in pkg/api/forbidden_list.go) with the stored string. In Go, regexp.MustCompile panics rather than returning an error on invalid input, terminating the webhook process. The CPE cpe:2.3:a:projectcapsule:capsule:*:*:*:*:*:*:*:* covers all releases before the v0.13.8 fix introduced by PR #1995, which added proper webhook-level validation of regex properties.
RemediationAI
Upgrade Capsule to v0.13.8 or later, which introduces webhook-level validation of regex fields in CapsuleConfiguration (PR #1995, commit 6a762e7). Docker image ghcr.io/projectcapsule/capsule:0.13.8 and the updated Helm chart are available from the project release page at https://github.com/projectcapsule/capsule/releases/tag/v0.13.8. If immediate upgrade is not feasible, audit all existing CapsuleConfiguration objects by running kubectl get capsuleconfiguration -o yaml and manually verifying Spec.NodeMetadata.ForbiddenLabels.Regex and Spec.NodeMetadata.ForbiddenAnnotations.Regex values compile as valid Go regex (e.g., using regexp.Compile in a test script). Additionally, restrict edit and patch permissions on CapsuleConfiguration resources via custom ClusterRole bindings to the smallest set of operators who genuinely require them - note this may interfere with normal Capsule administrative workflows if over-scoped. Advisory: https://github.com/projectcapsule/capsule/security/advisories/GHSA-68cj-mvg9-rgm2.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today