CVE-2026-61794: Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbiddenannotationsregex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbiddenlist.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capsule (multi-tenancy policy framework for Kubernetes)to a version that resolves this vulnerability.Fixed in 0.13.7
Event History
Frequently Asked Questions
Who can trigger this issue, and who is affected by the resulting outage?
An administrator who can update a Tenant must first save a malformed ForbiddenAnnotations.Regex while keeping ForbiddenLabels.Regex valid. Namespace creation or updates for the affected tenant can then panic during forbidden metadata validation, denying those namespace operations.
Are default deployments affected?
The issue requires a Tenant update containing a malformed ForbiddenAnnotations.Regex, so it is not triggered solely by running an affected Capsule version. Deployments are exposed if an administrator can persist such a Tenant configuration.
What should be done if an immediate upgrade is not possible?
Review Tenant resources for malformed ForbiddenAnnotations.Regex values and correct or remove any invalid expressions. Restrict Tenant update permissions to trusted administrators until the fixed version can be deployed.
Which versions are affected and which version fixes the issue?
Capsule versions from 0.13.0 until 0.13.7 are affected. The issue is fixed in version 0.13.7.