CVE-2026-61672

Overview

Capsule prior to version 0.13.7 contains a metadata validation flaw within ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go. The vulnerability occurs because case-insensitive sorting is mismatched with byte-order binary search, causing certain mixed-case forbidden metadata keys to be missed. This allows authenticated tenant owners to bypass namespace, service, or node metadata restrictions and influence cluster policies outside tenant boundaries.

Description

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When an administrator's forbidden list mixes capitalized and lowercase keys or otherwise has different case-insensitive and byte ordering, the binary search can return false for a key that is present. An authenticated tenant owner can then pass the missed key through api.ValidateForbidden and bypass configured namespace, Service, or delegated node metadata restrictions, potentially influencing cluster policies, network exposure, or scheduling outside the tenant boundary. Uniformly lowercase lists whose two orderings coincide are not affected. This issue is fixed in version 0.13.7.

Impact

The vulnerability primarily impacts the integrity and confidentiality of Kubernetes cluster multi-tenancy configurations. An authenticated tenant owner can exploit this validation bypass to apply unauthorized metadata, potentially affecting network exposure, scheduling, and overall cluster policies. Confidentiality and integrity of tenant boundaries are compromised. Availability is generally unaffected.

Remediation

Upgrade Capsule to version 0.13.7 or later where the sorting and binary search logic is corrected. As an immediate workaround before patching, ensure all forbidden metadata keys in the configuration are uniformly lowercase to ensure consistent case-insensitive and byte-order sorting.

Risk context

This vulnerability is rated as High severity with a CVSS v3 score of 7.1. It directly threatens multi-tenancy isolation guarantees in Kubernetes environments utilizing Capsule, requiring prompt patching by security administrators.

Affected products

• Clastix Capsule < 0.13.7