CVE-2026-61794

Overview

Capsule contains a tenant update validation flaw in versions 0.13.0 through 0.13.6, where forbidden annotations regex checks mistakenly compile label regex expressions instead. An administrator updating a tenant can persist a malformed annotation regex, causing a panic during subsequent namespace operations. This leads to a denial of service condition for namespace creations and updates within the affected tenant.

Description

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.

Impact

The primary impact is a denial of service affecting availability for specific tenant namespace operations. Integrity and confidentiality are not directly compromised by this vulnerability. The issue impacts Kubernetes clusters utilizing Capsule for multi-tenancy where administrative users manage tenant definitions.

Remediation

Upgrade the Capsule framework to version 0.13.7 or later where the tenant update validation logic is corrected. Review existing tenant configurations for malformed regular expressions in ForbiddenAnnotations.Regex fields. Ensure proper access controls are maintained for tenant update operations.

Risk context

Rated as a medium severity vulnerability with a CVSS v3 score of 6.8. EPSS data is not currently available. The risk is primarily operational, centered around potential service disruption for tenant namespace management.

Affected products

• Clastix Capsule