CVE-2026-61794 Details
Description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.
A vulnerability exists in Capsule, a multi-tenancy and policy-based framework for Kubernetes, versions 0.13.0 prior to 0.13.7. The issue arises in the Tenant update validation process, where the system incorrectly compiles the ForbiddenLabels.Regex for both labels and annotations checks. This flaw allows an administrator with the ability to update a Tenant to save a malformed ForbiddenAnnotations.Regex while keeping the labels expression valid. Subsequently, when creating or updating a Namespace, the invalid regex can cause a panic during the forbidden metadata validation, disrupting namespace operations for the affected tenant.
Users can upgrade to Capsule version 0.13.7, which addresses this vulnerability by correcting the validation process for regex in forbidden annotations.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/projectcapsule/capsule/security/advisories/GHSA-gxjc-74v5-3vx3 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e | [email protected] | Source CodeVendor |
| https://github.com/projectcapsule/capsule/pull/1983 | [email protected] | Issue TrackingSource CodeVendor |
| https://github.com/projectcapsule/capsule/releases/tag/v0.13.7 | [email protected] | Release NotesVendor |
| https://github.com/projectcapsule/capsule/security/advisories/GHSA-gxjc-74v5-3vx3 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capsule | >= 0.13.0, <= 0.13.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |