CVE-2026-55636: CWE-863: Incorrect Authorization in projectcapsule capsule
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC can send a PUT request to /api/v1/namespaces/{namespace}/finalize, and the singular rule never matches the plural resource, so the validating webhook is not invoked and the user can change the namespace tenant label. matchPolicy: Equivalent does not compensate because it handles API group and version equivalence rather than resource-name errors. This vulnerability is fixed in 0.13.6.
AI Analysis
Technical Summary
Capsule is a multi-tenancy and policy-based framework for Kubernetes. In versions 0.13.0 through 0.13.5, the validating webhook configuration in charts/capsule/templates/configuration.yaml incorrectly uses the resource name 'namespace/finalize' instead of the correct plural form 'namespaces/finalize'. Because of this misconfiguration, users with RBAC permissions for 'namespaces/finalize' can send PUT requests to the endpoint /api/v1/namespaces/{namespace}/finalize without triggering the validating webhook. The singular rule does not match the plural resource, and the matchPolicy setting 'Equivalent' does not address this resource-name mismatch. This allows unauthorized modification of the namespace tenant label. The vulnerability is resolved in version 0.13.6.
Potential Impact
An attacker with RBAC permissions for 'namespaces/finalize' can bypass the validating webhook and modify the tenant label of a Kubernetes namespace. This could lead to unauthorized changes in multi-tenant environments, potentially impacting tenant isolation and policy enforcement. The CVSS 3.1 score is 5.7 (medium severity), reflecting limited confidentiality impact but high integrity impact and low attack complexity.
Mitigation Recommendations
Upgrade Capsule to version 0.13.6 or later, where the validating webhook configuration correctly uses the plural resource name 'namespaces/finalize'. This fixes the authorization bypass. No other mitigations are indicated by the vendor advisory.
CVE-2026-55636: CWE-863: Incorrect Authorization in projectcapsule capsule
Description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC can send a PUT request to /api/v1/namespaces/{namespace}/finalize, and the singular rule never matches the plural resource, so the validating webhook is not invoked and the user can change the namespace tenant label. matchPolicy: Equivalent does not compensate because it handles API group and version equivalence rather than resource-name errors. This vulnerability is fixed in 0.13.6.
CVSS v3.1
Score 5.7medium
Affected software
projectcapsule
capsule
pkg:github/projectcapsule/capsuleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Capsule is a multi-tenancy and policy-based framework for Kubernetes. In versions 0.13.0 through 0.13.5, the validating webhook configuration in charts/capsule/templates/configuration.yaml incorrectly uses the resource name 'namespace/finalize' instead of the correct plural form 'namespaces/finalize'. Because of this misconfiguration, users with RBAC permissions for 'namespaces/finalize' can send PUT requests to the endpoint /api/v1/namespaces/{namespace}/finalize without triggering the validating webhook. The singular rule does not match the plural resource, and the matchPolicy setting 'Equivalent' does not address this resource-name mismatch. This allows unauthorized modification of the namespace tenant label. The vulnerability is resolved in version 0.13.6.
Potential Impact
An attacker with RBAC permissions for 'namespaces/finalize' can bypass the validating webhook and modify the tenant label of a Kubernetes namespace. This could lead to unauthorized changes in multi-tenant environments, potentially impacting tenant isolation and policy enforcement. The CVSS 3.1 score is 5.7 (medium severity), reflecting limited confidentiality impact but high integrity impact and low attack complexity.
Mitigation Recommendations
Upgrade Capsule to version 0.13.6 or later, where the validating webhook configuration correctly uses the plural resource name 'namespaces/finalize'. This fixes the authorization bypass. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T23:52:12.057Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa9651455bf5e2cf502e8e5
Added to database: 09/15/2026, 15:32:36 UTC
Last enriched: 09/15/2026, 16:17:45 UTC
Last updated: 09/15/2026, 22:18:53 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.