CVE-2026-61672: CWE-697: Incorrect Comparison in projectcapsule capsule
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When an administrator's forbidden list mixes capitalized and lowercase keys or otherwise has different case-insensitive and byte ordering, the binary search can return false for a key that is present. An authenticated tenant owner can then pass the missed key through api.ValidateForbidden and bypass configured namespace, Service, or delegated node metadata restrictions, potentially influencing cluster policies, network exposure, or scheduling outside the tenant boundary. Uniformly lowercase lists whose two orderings coincide are not affected. This issue is fixed in version 0.13.7.
AI Analysis
Technical Summary
Capsule's ForbiddenListSpec.ExactMatch function sorts denied metadata keys case-insensitively but then uses sort.SearchStrings, which assumes byte-order sorting. When the forbidden list mixes capitalized and lowercase keys, the binary search may fail to find keys that are present, allowing an authenticated tenant owner to bypass configured metadata restrictions. This can influence cluster policies, network exposure, or scheduling outside tenant boundaries. Uniformly lowercase lists are not affected. The vulnerability is resolved in Capsule version 0.13.7.
Potential Impact
An authenticated tenant owner can bypass configured namespace, service, or delegated node metadata restrictions by exploiting the incorrect comparison logic. This may lead to unauthorized influence over cluster policies, network exposure, or scheduling beyond the tenant's boundary. The confidentiality impact is low, integrity impact is high, and availability is not affected.
Mitigation Recommendations
Upgrade to Capsule version 0.13.7 or later, where this issue is fixed. No other mitigations are indicated by the vendor advisory.
CVE-2026-61672: CWE-697: Incorrect Comparison in projectcapsule capsule
Description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When an administrator's forbidden list mixes capitalized and lowercase keys or otherwise has different case-insensitive and byte ordering, the binary search can return false for a key that is present. An authenticated tenant owner can then pass the missed key through api.ValidateForbidden and bypass configured namespace, Service, or delegated node metadata restrictions, potentially influencing cluster policies, network exposure, or scheduling outside the tenant boundary. Uniformly lowercase lists whose two orderings coincide are not affected. This issue is fixed in version 0.13.7.
CVSS v3.1
Score 7.1high
Affected software
projectcapsule
capsule
pkg:github/projectcapsule/capsuleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Capsule's ForbiddenListSpec.ExactMatch function sorts denied metadata keys case-insensitively but then uses sort.SearchStrings, which assumes byte-order sorting. When the forbidden list mixes capitalized and lowercase keys, the binary search may fail to find keys that are present, allowing an authenticated tenant owner to bypass configured metadata restrictions. This can influence cluster policies, network exposure, or scheduling outside tenant boundaries. Uniformly lowercase lists are not affected. The vulnerability is resolved in Capsule version 0.13.7.
Potential Impact
An authenticated tenant owner can bypass configured namespace, service, or delegated node metadata restrictions by exploiting the incorrect comparison logic. This may lead to unauthorized influence over cluster policies, network exposure, or scheduling beyond the tenant's boundary. The confidentiality impact is low, integrity impact is high, and availability is not affected.
Mitigation Recommendations
Upgrade to Capsule version 0.13.7 or later, where this issue is fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-10T18:25:21.468Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aad6b0a55bf5e2cf541929c
Added to database: 09/18/2026, 16:47:06 UTC
Last enriched: 09/18/2026, 17:01:28 UTC
Last updated: 09/18/2026, 23:18:40 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.