github.com/projectcapsule/capsule vulnerabilities (Go)
11 vulnerabilities.
-
github.com/projectcapsule/capsuleGo Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation 6.8 Medium -
github.com/projectcapsule/capsuleGo Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement 7.1 High -
github.com/projectcapsule/capsuleGo Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic 6.8 Medium -
github.com/projectcapsule/capsuleGo Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) 6.6 Medium -
github.com/projectcapsule/capsuleGo Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests 6.8 Medium -
github.com/projectcapsule/capsuleGo Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected 5.7 Medium -
github.com/projectcapsule/capsuleGo Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability 6.9 Medium -
github.com/projectcapsule/capsuleGo Capsule Namespace Hijacking via subresource 3.9 Low -
github.com/projectcapsule/capsuleGo Capsule tenant owners with "patch namespace" permission can hijack system namespaces label 9.1 Critical -
github.com/projectcapsule/capsuleGo Capsule tenant owner with "patch namespace" permission can hijack system namespaces 8.5 High -
github.com/projectcapsule/capsuleGo Service accounts can see namespaces of other tenants in capsule-proxy 4.3 Medium