CVE-2026-61795 Details
Description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7.
A vulnerability exists in Capsule, a multi-tenancy framework for Kubernetes, versions 0.13.0 prior to 0.13.7. The issue arises in the hostnameRegexHandler.OnUpdate method, where the new and old Tenant parameters are reversed. This flaw allows a cluster administrator to submit a malformed regex for allowed hostnames, which the webhook mistakenly validates as correct. As a result, the invalid regex is stored, causing subsequent Ingress operations to fail. The issue blocks Ingress updates or creations for the affected tenant until the Tenant configuration is manually corrected.
Users can upgrade to Capsule version 0.13.7, where this vulnerability is patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e | [email protected] | Source CodeVendor |
| https://github.com/projectcapsule/capsule/pull/1983 | [email protected] | Source CodeVendor |
| https://github.com/projectcapsule/capsule/releases/tag/v0.13.7 | [email protected] | Release NotesVendor |
| https://github.com/projectcapsule/capsule/security/advisories/GHSA-f94q-w3w8-cj67 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-697 | Incorrect Comparison | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capsule | >= 0.13.0, <= 0.13.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |