Projectcapsule Capsule vulnerabilities

• projectcapsule capsule Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation CVE-2026-61795 Fix available 6.8 MediumSeptember 18, 2026
• projectcapsule capsule Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement CVE-2026-61672 Fix available 7.1 HighSeptember 18, 2026
• projectcapsule capsule Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic CVE-2026-61794 Fix available 6.8 MediumSeptember 18, 2026
• projectcapsule capsule Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) CVE-2026-65835 Fix available 6.6 MediumJuly 30, 2026
• projectcapsule capsule Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests CVE-2026-65834 Fix available 6.8 MediumJuly 30, 2026
• projectcapsule capsule Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected CVE-2026-55636 Fix available 5.7 MediumJune 17, 2026
• projectcapsule capsule Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability CVE-2026-22872 Fix available 6.9 MediumMay 28, 2026
• projectcapsule capsule Capsule Namespace Hijacking via subresource CVE-2026-30963 Fix available 3.9 LowMay 28, 2026
• projectcapsule capsule Capsule tenant owners with "patch namespace" permission can hijack system namespaces label CVE-2025-55205 Fix available 9.1 CriticalAugust 18, 2025
• clastix capsule Capsule tenant owner with "patch namespace" permission can hijack system namespaces CVE-2024-39690 Fix available 8.5 HighAugust 20, 2024
• clastix capsule-proxy Authentication bypass using an empty token in capsule-proxy CVE-2023-48312 Fix available 9.8 CriticalNovember 24, 2023
• clastix capsule, capsule-proxy +1 more Service accounts can see namespaces of other tenants in capsule-proxy CVE-2023-46254 Fix available 4.3 MediumNovember 6, 2023
• clastix capsule Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace CVE-2022-46167 Fix available 8.8 HighDecember 2, 2022