CVE-2026-65834 Details
Description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster Admin to store a malformed regex that later reached regexp.MustCompile in pkg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and crashed the node admission webhook on Node create, update, or patch requests. This issue is fixed in version 0.13.8.
A vulnerability exists in the Capsule Kubernetes framework, specifically in versions prior to 0.13.8. The issue arises because the regex fields for forbidden labels and annotations in the CapsuleConfiguration NodeMetadata are not validated by the admission webhook. This lack of validation allows a Cluster Admin to save a malformed regex, which then causes a panic by crashing the node admission webhook during Node creation, update, or patch requests. As a result, this vulnerability creates a cluster-wide denial-of-service condition for all Node operations.
Users can upgrade to Capsule version 0.13.8, which includes the necessary validation for the NodeMetadata regex fields in the admission webhook, preventing the storage of malformed regexes that could cause a webhook panic.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/projectcapsule/capsule/security/advisories/GHSA-68cj-mvg9-rgm2 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/projectcapsule/capsule/releases/tag/v0.13.8 | [email protected] | Release NotesVendor |
| https://github.com/projectcapsule/capsule/security/advisories/GHSA-68cj-mvg9-rgm2 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-248 | Uncaught Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capsule | <= 0.13.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |