CVE-2026-61795

Overview

Capsule versions 0.13.0 through 0.13.6 contain a parameter inversion flaw in the hostname regex validation webhook during tenant updates. This defect causes the validation logic to check stale state rather than newly submitted values, allowing malformed regular expressions to be stored. Consequently, subsequent Ingress operations for the affected tenant fail and are blocked until manual administrative intervention occurs.

Description

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7.

Impact

The vulnerability primarily impacts system availability for specific tenants by preventing the creation or modification of Ingress resources. Confidentiality and integrity are not directly compromised, but denial of service occurs at the tenant level due to persistent validation failures. Cluster administrators and multi-tenant organizations relying on Capsule for isolation are affected.

Remediation

Upgrade the Capsule framework to version 0.13.7 or later where the parameter inversion is resolved. Review existing tenant configurations for malformed AllowedHostnames.Regex values and repair them if Ingress operations are currently blocked.

Risk context

Assigned a medium severity with a CVSS v3 score of 6.8, this issue presents an operational availability risk rather than a remote code execution vector. Defenders should prioritize patching during standard maintenance windows to restore full tenant management capabilities.

Affected products

• Clastix Capsule