Skip to main content
A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Find Out Why
Vulnerability Database/CVE-2026-55636

CVE-2026-55636: Capsule Kubernetes Auth Bypass Vulnerability

CVE-2026-55636 is an authentication bypass flaw in Capsule, a multi-tenancy framework for Kubernetes, allowing users to modify namespace tenant labels. This post explains its technical details, affected versions, and mitigation.

Published:

CVE-2026-55636 Overview

Capsule is a multi-tenancy and policy-based framework for Kubernetes that enforces tenant isolation through validating admission webhooks. CVE-2026-55636 is an authorization bypass [CWE-863] in Capsule versions 0.13.0 through 0.13.5. The Helm chart at charts/capsule/templates/configuration.yaml registers the validating webhook against the resource name namespace/finalize instead of the correct Kubernetes resource namespaces/finalize. A user granted namespaces/finalize RBAC can send a PUT request to /api/v1/namespaces/{namespace}/finalize that never matches the malformed webhook rule. The tenant label on the namespace can then be modified, breaking tenant isolation.

Critical Impact

An authenticated tenant user with namespaces/finalize permissions can bypass Capsule's validating webhook and reassign a namespace to a different tenant, undermining multi-tenant isolation guarantees.

Affected Products

  • Capsule 0.13.0 through 0.13.5
  • Capsule Helm chart shipping charts/capsule/templates/configuration.yaml with the malformed webhook rule
  • Kubernetes clusters relying on Capsule for tenant enforcement

Discovery Timeline

  • 2026-09-15 - CVE-2026-55636 published to NVD
  • 2026-09-15 - Last updated in NVD database
  • Fix release - Project Capsule releases version 0.13.6 containing the patch

Technical Details for CVE-2026-55636

Vulnerability Analysis

Capsule enforces tenant boundaries by intercepting namespace mutations through a Kubernetes ValidatingWebhookConfiguration. The webhook is expected to inspect every request that touches namespace finalizers, including the capsule.clastix.io/tenant label that binds a namespace to its owning tenant. The rule shipped in the Helm chart declares the resource as namespace/finalize (singular) rather than the Kubernetes-native plural form namespaces/finalize. Kubernetes admission matching is strictly literal on resource names, so requests targeting the real subresource never invoke the webhook.

The consequence is a silent authorization gap. A tenant owner or any principal granted the namespaces/finalize verb can issue a PUT against /api/v1/namespaces/{namespace}/finalize with a modified tenant label, and the API server accepts the change without validation. This allows cross-tenant namespace hijacking, which can lead to workload disclosure, tampering with tenant-scoped resources, and disruption of tenant isolation policies.

Root Cause

The root cause is a resource-name typo in the ValidatingWebhookConfiguration template. The webhook rule matches namespace/finalize while the Kubernetes API exposes the subresource as namespaces/finalize. The matchPolicy: Equivalent setting does not help because it reconciles API group and version differences, not resource-name mismatches. The result is a webhook that is registered but never triggered for the intended requests.

Attack Vector

Exploitation requires an authenticated Kubernetes user or ServiceAccount with the namespaces/finalize verb granted via RBAC, plus user interaction as reflected in the CVSS vector. The attacker issues a PUT request to /api/v1/namespaces/{target-namespace}/finalize containing a namespace object whose Capsule tenant label points to a tenant they control. Because the malformed webhook rule does not match, admission review is skipped and the API server persists the change.

go
// Patch excerpt from cmd/controller/main.go registering the new owners webhook
namespacemutation "github.com/projectcapsule/capsule/internal/webhook/namespace/mutation"
namespacevalidation "github.com/projectcapsule/capsule/internal/webhook/namespace/validation"
"github.com/projectcapsule/capsule/internal/webhook/node"
"github.com/projectcapsule/capsule/internal/webhook/owners"
"github.com/projectcapsule/capsule/internal/webhook/pod"
"github.com/projectcapsule/capsule/internal/webhook/pvc"
"github.com/projectcapsule/capsule/internal/webhook/resourcepool"

Source: GitHub Commit af2f377

Detect Identity Attacks the Moment Authentication Fails

Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.

Stop Identity Attacks

Detection Methods for CVE-2026-55636

Indicators of Compromise

  • Kubernetes audit log entries showing PUT requests to /api/v1/namespaces/{namespace}/finalize from non-cluster-admin users.
  • Namespace objects whose Capsule tenant label (for example capsule.clastix.io/tenant) changed without a corresponding Tenant controller reconciliation event.
  • ValidatingWebhookConfiguration for Capsule containing a rule with resources: ["namespace/finalize"] instead of namespaces/finalize.

Detection Strategies

  • Query the Kubernetes API audit log for subresource=finalize events on namespaces and correlate the requesting user with expected Capsule tenant owners.
  • Diff live namespace tenant labels against the desired state enforced by the Tenant custom resource to surface unauthorized reassignments.
  • Inspect installed Capsule Helm releases and enumerate webhook rules for the namespace/finalize typo across all managed clusters.

Monitoring Recommendations

  • Enable Kubernetes API server audit logging at the RequestResponse level for the namespaces resource and its finalize subresource.
  • Alert on any modification to the Capsule tenant label that does not originate from a Capsule controller ServiceAccount.
  • Track Capsule chart versions in inventory and flag any deployment running 0.13.0 through 0.13.5.

How to Mitigate CVE-2026-55636

Immediate Actions Required

  • Upgrade Capsule to version 0.13.6 or later on every affected cluster.
  • Audit RBAC bindings and remove namespaces/finalize verbs from any principal that does not strictly require them.
  • Review recent audit logs for PUT /api/v1/namespaces/{namespace}/finalize activity and validate the integrity of tenant labels.

Patch Information

The fix is delivered in Capsule 0.13.6. Pull request #1966 corrects the webhook rule and adds ServiceAccount validation for tenant owners and tenants. Full details are available in the GitHub Security Advisory GHSA-gwxr-7h77-7777 and the GitHub Release v0.13.6.

Workarounds

  • Manually edit the deployed ValidatingWebhookConfiguration and change the resource entry from namespace/finalize to namespaces/finalize until the upgrade is applied.
  • Restrict namespaces/finalize RBAC to cluster administrators through a temporary ClusterRole override.
  • Use an external policy engine such as Kyverno or OPA Gatekeeper to reject unauthorized changes to the Capsule tenant label on namespace finalizers.
bash
# Patch the Capsule validating webhook to use the correct subresource name
kubectl patch validatingwebhookconfiguration capsule-validating-webhook-configuration \
  --type='json' \
  -p='[{"op":"replace","path":"/webhooks/0/rules/0/resources","value":["namespaces/finalize"]}]'

# Or upgrade directly to the patched release
helm repo update
helm upgrade capsule projectcapsule/capsule --version 0.13.6 -n capsule-system

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne