Capsule
Monthly
Capsule, the Kubernetes multi-tenancy and policy framework (projectcapsule/capsule), mishandles case-insensitive sorting in its forbidden-list lookup on versions prior to 0.13.7, allowing an authenticated tenant owner to slip denied metadata keys past api.ValidateForbidden and bypass configured namespace, Service, or delegated node metadata restrictions - potentially altering cluster policies, network exposure, or pod scheduling outside the tenant boundary. Exploitation is conditional: the cluster administrator's forbidden list must mix capitalized and lowercase keys (or otherwise produce different case-insensitive and byte-order sortings), which is why the assessed vector is AV:N/AC:H/PR:L with scope change and high integrity impact. The flaw maps to CWE-697 (Incorrect Comparison), and no public exploit code or confirmed in-the-wild activity has been identified at time of analysis; a vendor fix is available in 0.13.7.
In Capsule 0.13.0 through 0.13.6, the Tenant validating admission webhook's hostnameRegexHandler.OnUpdate passes the new and old Tenant objects in the wrong order, so an update is validated against the previously stored AllowedHostnames.Regex rather than the newly submitted one; a cluster administrator can therefore persist a malformed regex that the webhook should have rejected. Because the Ingress hostname validator in validate_hostnames.go discards the regular-expression compilation error and treats every hostname as unmatched, the affected tenant's Ingress create and update operations are subsequently blocked until an administrator repairs the Tenant spec. The issue requires Tenant update privileges (PR:H in the assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H vector), is confined to tenants that use IngressOptions.AllowedHostnames.Regex, and no public exploit code has been identified at time of analysis; it is fixed in 0.13.7.
Capsule 0.13.0 through 0.13.6 accepts a malformed ForbiddenAnnotations.Regex on Tenant updates because the update webhook validates ForbiddenLabels.Regex for both the labels and annotations checks, letting a privileged tenant administrator persist a bad regular expression that later panics Capsule's forbidden-metadata validator and blocks namespace creation and updates for the affected tenant. Exploitation requires authenticated, high-privileged access - a Tenant update permission (tenant owner or cluster admin with Tenant write access, CVSS PR:H) - and the impact is a tenant-scoped denial of service with no confidentiality or integrity effect (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, CWE-20). There is no public exploit identified at time of analysis, no CISA KEV listing, and the issue is fixed in version 0.13.7, making this a genuine but low-urgency availability bug rather than a high-impact priority.
Privilege escalation in Capsule (Kubernetes multi-tenancy framework) versions 0.13.0-0.13.7 allows authenticated Tenant Owners to break out of tenant isolation and create cluster-scoped Kubernetes resources - including ClusterRole, ClusterRoleBinding, and ValidatingWebhookConfiguration - through the cluster-admin controller client. This is an incomplete fix of CVE-2026-22872: the TenantResource RawItems and Generators code paths (handleRawItem, handleGeneratorItem) were never updated to enforce the same cluster-scoped resource rejection guards applied to NamespacedItems. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v0.13.8 is available.
Capsule's node admission webhook can be crashed cluster-wide by a Cluster Admin who stores a malformed regular expression in CapsuleConfiguration's NodeMetadata fields, causing a Go panic via regexp.MustCompile that blocks all subsequent Node create, update, and patch operations. All Capsule versions prior to 0.13.8 are affected, as confirmed by GitHub Security Advisory GHSA-68cj-mvg9-rgm2. No public exploit has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that the crash cascades beyond the vulnerable Capsule component to impair node admission cluster-wide.
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
capsule-proxy is a reverse proxy for Capsule kubernetes multi-tenancy framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Capsule, the Kubernetes multi-tenancy and policy framework (projectcapsule/capsule), mishandles case-insensitive sorting in its forbidden-list lookup on versions prior to 0.13.7, allowing an authenticated tenant owner to slip denied metadata keys past api.ValidateForbidden and bypass configured namespace, Service, or delegated node metadata restrictions - potentially altering cluster policies, network exposure, or pod scheduling outside the tenant boundary. Exploitation is conditional: the cluster administrator's forbidden list must mix capitalized and lowercase keys (or otherwise produce different case-insensitive and byte-order sortings), which is why the assessed vector is AV:N/AC:H/PR:L with scope change and high integrity impact. The flaw maps to CWE-697 (Incorrect Comparison), and no public exploit code or confirmed in-the-wild activity has been identified at time of analysis; a vendor fix is available in 0.13.7.
In Capsule 0.13.0 through 0.13.6, the Tenant validating admission webhook's hostnameRegexHandler.OnUpdate passes the new and old Tenant objects in the wrong order, so an update is validated against the previously stored AllowedHostnames.Regex rather than the newly submitted one; a cluster administrator can therefore persist a malformed regex that the webhook should have rejected. Because the Ingress hostname validator in validate_hostnames.go discards the regular-expression compilation error and treats every hostname as unmatched, the affected tenant's Ingress create and update operations are subsequently blocked until an administrator repairs the Tenant spec. The issue requires Tenant update privileges (PR:H in the assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H vector), is confined to tenants that use IngressOptions.AllowedHostnames.Regex, and no public exploit code has been identified at time of analysis; it is fixed in 0.13.7.
Capsule 0.13.0 through 0.13.6 accepts a malformed ForbiddenAnnotations.Regex on Tenant updates because the update webhook validates ForbiddenLabels.Regex for both the labels and annotations checks, letting a privileged tenant administrator persist a bad regular expression that later panics Capsule's forbidden-metadata validator and blocks namespace creation and updates for the affected tenant. Exploitation requires authenticated, high-privileged access - a Tenant update permission (tenant owner or cluster admin with Tenant write access, CVSS PR:H) - and the impact is a tenant-scoped denial of service with no confidentiality or integrity effect (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, CWE-20). There is no public exploit identified at time of analysis, no CISA KEV listing, and the issue is fixed in version 0.13.7, making this a genuine but low-urgency availability bug rather than a high-impact priority.
Privilege escalation in Capsule (Kubernetes multi-tenancy framework) versions 0.13.0-0.13.7 allows authenticated Tenant Owners to break out of tenant isolation and create cluster-scoped Kubernetes resources - including ClusterRole, ClusterRoleBinding, and ValidatingWebhookConfiguration - through the cluster-admin controller client. This is an incomplete fix of CVE-2026-22872: the TenantResource RawItems and Generators code paths (handleRawItem, handleGeneratorItem) were never updated to enforce the same cluster-scoped resource rejection guards applied to NamespacedItems. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v0.13.8 is available.
Capsule's node admission webhook can be crashed cluster-wide by a Cluster Admin who stores a malformed regular expression in CapsuleConfiguration's NodeMetadata fields, causing a Go panic via regexp.MustCompile that blocks all subsequent Node create, update, and patch operations. All Capsule versions prior to 0.13.8 are affected, as confirmed by GitHub Security Advisory GHSA-68cj-mvg9-rgm2. No public exploit has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that the crash cascades beyond the vulnerable Capsule component to impair node admission cluster-wide.
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
capsule-proxy is a reverse proxy for Capsule kubernetes multi-tenancy framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.