CVE-2026-65834 is an improper input validation vulnerability in the projectcapsule Capsule framework affecting versions before 0.13.8. The issue arises because the configuration admission webhook does not validate the regex patterns stored in CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and ForbiddenAnnotations.Regex. A Cluster Admin can submit malformed regex patterns that cause the node admission webhook to crash when processing Node create, update, or patch requests, due to a failure in regexp.MustCompile in the code path. This vulnerability results in denial of service of the node admission webhook. The issue is fixed in version 0.13.8.

An attacker with Cluster Admin privileges can cause the node admission webhook to crash by submitting malformed regex patterns in the Capsule configuration. This leads to denial of service for node admission operations (create, update, patch), potentially disrupting cluster management workflows. There is no direct confidentiality or integrity impact reported.

Upgrade to projectcapsule Capsule version 0.13.8 or later, where the configuration admission webhook properly validates regex inputs to prevent malformed patterns. Patch status is confirmed fixed in 0.13.8. No other mitigation is indicated.