CVE-2026-61794: CWE-20: Improper Input Validation in projectcapsule capsule
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.
AI Analysis
Technical Summary
Capsule versions >=0.13.0 and <0.13.7 contain a flaw in Tenant update validation where ForbiddenAnnotations.Regex is not properly validated. Instead, the regex for forbidden labels is compiled twice, allowing a malformed ForbiddenAnnotations.Regex to be stored. When namespace operations later validate metadata using this stored regex, regexp.MustCompile can panic, causing denial of service for namespace creation or updates for that tenant. This vulnerability is classified as CWE-20 (Improper Input Validation) and has a CVSS 3.1 score of 6.8 (medium severity). The flaw is corrected in version 0.13.7.
Potential Impact
An administrator with permission to update a Tenant can cause denial of service for namespace creation or update operations by persisting a malformed forbidden annotations regex. This leads to a panic in the regex compilation during forbidden metadata validation, disrupting normal namespace operations for the affected tenant. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade Capsule to version 0.13.7 or later where this issue is fixed. No other mitigation is indicated or required.
CVE-2026-61794: CWE-20: Improper Input Validation in projectcapsule capsule
Description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.
CVSS v3.1
Score 6.8medium
Affected software
projectcapsule
capsule
pkg:github/projectcapsule/capsuleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Capsule versions >=0.13.0 and <0.13.7 contain a flaw in Tenant update validation where ForbiddenAnnotations.Regex is not properly validated. Instead, the regex for forbidden labels is compiled twice, allowing a malformed ForbiddenAnnotations.Regex to be stored. When namespace operations later validate metadata using this stored regex, regexp.MustCompile can panic, causing denial of service for namespace creation or updates for that tenant. This vulnerability is classified as CWE-20 (Improper Input Validation) and has a CVSS 3.1 score of 6.8 (medium severity). The flaw is corrected in version 0.13.7.
Potential Impact
An administrator with permission to update a Tenant can cause denial of service for namespace creation or update operations by persisting a malformed forbidden annotations regex. This leads to a panic in the regex compilation during forbidden metadata validation, disrupting normal namespace operations for the affected tenant. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade Capsule to version 0.13.7 or later where this issue is fixed. No other mitigation is indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-10T20:06:05.617Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aad678855bf5e2cf53e1038
Added to database: 09/18/2026, 16:32:08 UTC
Last enriched: 09/18/2026, 16:47:02 UTC
Last updated: 09/18/2026, 22:12:51 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.