projectcapsule capsule vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Latest projectcapsule capsule vulnerabilities

CVE-2026-61795 — Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation (CVSS 6.8)
CVE-2026-61794 — Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic (CVSS 6.8)
CVE-2026-61672 — Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement (CVSS 7.1)
CVE-2026-55636 — Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected (CVSS 5.7)
CVE-2026-65835 — Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) (CVSS 6.6)
CVE-2026-65834 — Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests (CVSS 6.8)
CVE-2026-30963 — Capsule Namespace Hijacking via subresource (CVSS 2.7)
CVE-2026-22872 — Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability (CVSS 9.1)
CVE-2025-55205 — Capsule tenant owners with "patch namespace" permission can hijack system namespaces label (CVSS 9.0)
CVE-2024-39690 — Capsule tenant owner with "patch namespace" permission can hijack system namespaces (CVSS 8.8)