CVE-2026-65834: falha de média gravidade em projectcapsule capsule
Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.3%
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster Admin to store a malformed regex that later reached regexp.MustCompile in pkg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and crashed the node admission webhook on Node create, update, or patch requests. This issue is fixed in version 0.13.8.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Produtos afetados
projectcapsule · capsuleCVEs relacionadas — projectcapsule capsule
No mesmo produto, das mais perigosas para as menos.
CVE-2026-22872MEDIUMCapsule TenantResource RawItems Cluster-Scoped Resource Creation VulnerabilityEPSS 0.7%CVE-2026-61795MEDIUMCapsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validationEPSS 0.6%CVE-2026-61794MEDIUMCapsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panicEPSS 0.6%CVE-2024-39690HIGHCapsule tenant owner with "patch namespace" permission can hijack system namespacesEPSS 0.5%CVE-2025-55205CRITICALCapsule tenant owners with "patch namespace" permission can hijack system namespaces labelEPSS 0.5%CVE-2026-55636MEDIUMCapsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotectedEPSS 0.4%