CVE-2026-61795

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7.

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7.

Summary

A parameter order bug in internal/webhook/tenant/validation/hostname_regex.go causes the hostnameRegexHandler.OnUpdate webhook to validate the old Tenant object's AllowedHostnames.Regex instead of the new one being submitted. This allows an invalid (malformed) regex to bypass admission validation and be persisted to etcd, causing a Denial of Service for all Ingress operations within the affected tenant.

Details

The TypedHandler[T] interface defines OnUpdate as:

// handlers.go
OnUpdate(c client.Client, reader client.Reader, obj T, old T, decoder admission.Decoder, recorder events.EventRecorder) Func
//                                               ^^^ NEW  ^^^ OLD

The dispatcher in handler.go:93 calls:

hndl.OnUpdate(c, reader, tnt, old, decoder, recorder)
//                        ^^^ NEW  ^^^ OLD

However, hostnameRegexHandler.OnUpdate in hostname_regex.go declares its parameters in reversed order:

// hostname_regex.go (BUGGY)
func (h *hostnameRegexHandler) OnUpdate(
    _ client.Client,
    _ client.Reader,
    old *capsulev1beta2.Tenant,   // ← receives NEW tenant (mislabeled as old)
    tnt *capsulev1beta2.Tenant,   // ← receives OLD tenant (mislabeled as tnt)
    ...
) handlers.Func {
    return func(...) *admission.Response {
        if err := h.validate(tnt, req); err != nil { // ← validates OLD, not NEW
            return err
        }
        return nil
    }
}

All 11 other handlers in the same package declare (tnt, old) correctly. hostname_regex.go is the only one with the swap.

As a result, when a Cluster Admin updates Tenant.Spec.IngressOptions.AllowedHostnames.Regex to a malformed value, the webhook compiles the previous valid regex and returns Allow. The malformed regex is then written to etcd.

Subsequently, every Ingress CREATE or UPDATE in that tenant triggers validate_hostnames.go:160:

matched, _ = regexp.MatchString(allowedRegex, currentHostname)

regexp.MatchString with an invalid pattern returns (false, error). The error is silently ignored, matched is false, and every hostname is rejected — blocking all Ingress operations in the tenant until the Tenant object is manually corrected by an admin.

PoC

//go:build ignore
// Standalone reproducer for hostname_regex.go argument swap bug in Capsule
// No external deps - shows the bug logic using only stdlib

package main

import (
	"fmt"
	"regexp"
)

// Simulating the Tenant spec structure
type AllowedHostnames struct {
	Regex string
}

type IngressOptions struct {
	AllowedHostnames *AllowedHostnames
}

type TenantSpec struct {
	IngressOptions IngressOptions
}

type Tenant struct {
	Name string
	Spec TenantSpec
}

// =========================================================
// BUGGY implementation (hostname_regex.go as-is)
// OnUpdate(_, _, old *Tenant, tnt *Tenant) → validates OLD
// =========================================================
func hostnameValidate(tnt *Tenant) error {
	if tnt.Spec.IngressOptions.AllowedHostnames == nil {
		return nil
	}
	if len(tnt.Spec.IngressOptions.AllowedHostnames.Regex) == 0 {
		return nil
	}
	_, err := regexp.Compile(tnt.Spec.IngressOptions.AllowedHostnames.Regex)
	if err != nil {
		return fmt.Errorf("Deny: unable to compile allowedHostnames allowedRegex")
	}
	return nil
}

// Dispatcher calls: OnUpdate(c, reader, newTenant, oldTenant, ...)
// Interface says:   OnUpdate(c, reader, obj[NEW], old[OLD], ...)
//
// BUGGY handler receives: (old, tnt) meaning:
//   3rd param (labeled "old") = actually NEW
//   4th param (labeled "tnt") = actually OLD
// Then calls h.validate(tnt) = validates the OLD tenant
func buggyOnUpdate(newTenant, oldTenant *Tenant) error {
	// BUG: parameters are SWAPPED vs the interface contract
	old := newTenant // dispatcher's "new" arrives as "old" in this function
	tnt := oldTenant // dispatcher's "old" arrives as "tnt" in this function
	_ = old          // unused…

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7.

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7.

Summary

A parameter order bug in internal/webhook/tenant/validation/hostname_regex.go causes the hostnameRegexHandler.OnUpdate webhook to validate the old Tenant object's AllowedHostnames.Regex instead of the new one being submitted. This allows an invalid (malformed) regex to bypass admission validation and be persisted to etcd, causing a Denial of Service for all Ingress operations within the affected tenant.

Details

The TypedHandler[T] interface defines OnUpdate as:

// handlers.go
OnUpdate(c client.Client, reader client.Reader, obj T, old T, decoder admission.Decoder, recorder events.EventRecorder) Func
//                                               ^^^ NEW  ^^^ OLD

The dispatcher in handler.go:93 calls:

hndl.OnUpdate(c, reader, tnt, old, decoder, recorder)
//                        ^^^ NEW  ^^^ OLD

However, hostnameRegexHandler.OnUpdate in hostname_regex.go declares its parameters in reversed order:

// hostname_regex.go (BUGGY)
func (h *hostnameRegexHandler) OnUpdate(
    _ client.Client,
    _ client.Reader,
    old *capsulev1beta2.Tenant,   // ← receives NEW tenant (mislabeled as old)
    tnt *capsulev1beta2.Tenant,   // ← receives OLD tenant (mislabeled as tnt)
    ...
) handlers.Func {
    return func(...) *admission.Response {
        if err := h.validate(tnt, req); err != nil { // ← validates OLD, not NEW
            return err
        }
        return nil
    }
}

All 11 other handlers in the same package declare (tnt, old) correctly. hostname_regex.go is the only one with the swap.

As a result, when a Cluster Admin updates Tenant.Spec.IngressOptions.AllowedHostnames.Regex to a malformed value, the webhook compiles the previous valid regex and returns Allow. The malformed regex is then written to etcd.

Subsequently, every Ingress CREATE or UPDATE in that tenant triggers validate_hostnames.go:160:

matched, _ = regexp.MatchString(allowedRegex, currentHostname)

regexp.MatchString with an invalid pattern returns (false, error). The error is silently ignored, matched is false, and every hostname is rejected — blocking all Ingress operations in the tenant until the Tenant object is manually corrected by an admin.

PoC

//go:build ignore
// Standalone reproducer for hostname_regex.go argument swap bug in Capsule
// No external deps - shows the bug logic using only stdlib

package main

import (
	"fmt"
	"regexp"
)

// Simulating the Tenant spec structure
type AllowedHostnames struct {
	Regex string
}

type IngressOptions struct {
	AllowedHostnames *AllowedHostnames
}

type TenantSpec struct {
	IngressOptions IngressOptions
}

type Tenant struct {
	Name string
	Spec TenantSpec
}

// =========================================================
// BUGGY implementation (hostname_regex.go as-is)
// OnUpdate(_, _, old *Tenant, tnt *Tenant) → validates OLD
// =========================================================
func hostnameValidate(tnt *Tenant) error {
	if tnt.Spec.IngressOptions.AllowedHostnames == nil {
		return nil
	}
	if len(tnt.Spec.IngressOptions.AllowedHostnames.Regex) == 0 {
		return nil
	}
	_, err := regexp.Compile(tnt.Spec.IngressOptions.AllowedHostnames.Regex)
	if err != nil {
		return fmt.Errorf("Deny: unable to compile allowedHostnames allowedRegex")
	}
	return nil
}

// Dispatcher calls: OnUpdate(c, reader, newTenant, oldTenant, ...)
// Interface says:   OnUpdate(c, reader, obj[NEW], old[OLD], ...)
//
// BUGGY handler receives: (old, tnt) meaning:
//   3rd param (labeled "old") = actually NEW
//   4th param (labeled "tnt") = actually OLD
// Then calls h.validate(tnt) = validates the OLD tenant
func buggyOnUpdate(newTenant, oldTenant *Tenant) error {
	// BUG: parameters are SWAPPED vs the interface contract
	old := newTenant // dispatcher's "new" arrives as "old" in this function
	tnt := oldTenant // dispatcher's "old" arrives as "tnt" in this function
	_ = old          // unused…

Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation in github.com/projectcapsule/capsule