CVE-2026-61672: Capsule Kubernetes Auth Bypass Vulnerability

CVE-2026-61672 Overview

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Versions prior to 0.13.7 contain a logic flaw in ForbiddenListSpec.ExactMatch within pkg/api/forbidden_list.go. The function sorts denied metadata keys case-insensitively but then invokes sort.SearchStrings, which relies on byte-order sorting. This ordering mismatch causes the binary search to miss keys that are actually present in the forbidden list. An authenticated tenant owner can bypass configured namespace, Service, or delegated node metadata restrictions and influence cluster policies, network exposure, or scheduling outside the tenant boundary.

Critical Impact
Authenticated tenant owners can bypass administrator-configured metadata restrictions in Capsule, breaking multi-tenant isolation and enabling policy manipulation across the Kubernetes cluster.

Affected Products

Project Capsule capsule versions prior to 0.13.7
Kubernetes clusters using Capsule for multi-tenancy enforcement
Environments with mixed-case entries in ForbiddenListSpec.ExactMatch configurations

Discovery Timeline

2026-09-18 - CVE-2026-61672 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-61672

Vulnerability Analysis

The flaw resides in Capsule's forbidden list matching logic used to enforce tenant metadata restrictions. ForbiddenListSpec.ExactMatch normalizes denied keys through case-insensitive sorting. It then queries the resulting slice with sort.SearchStrings, a Go standard library function that assumes lexicographic byte-order sorting. When the two orderings diverge, the binary search terminates on an incorrect index and reports a match as absent.

The validation path api.ValidateForbidden treats this false-negative result as authoritative. A tenant owner supplying the missed key passes validation and applies metadata that should be blocked. This categorizes as an Incorrect Comparison weakness [CWE-697].

The impact scope extends beyond the tenant boundary because Capsule mediates access to shared cluster primitives. Bypassed restrictions on namespace labels, Service annotations, or delegated node metadata can influence scheduling, network policy selection, and admission controller decisions across the cluster.

Root Cause

The root cause is an algorithmic contract violation between the sorting stage and the search stage. sort.SearchStrings requires that the input slice be sorted in the same order the function itself uses for comparison, which is byte-order. Capsule sorts case-insensitively before calling this function, producing an ordering that breaks the binary search invariant. Forbidden lists that are uniformly lowercase happen to coincide in both orderings and are not affected.

Attack Vector

Exploitation requires authenticated access as a tenant owner within a Capsule-managed cluster. The attacker inspects the administrator's forbidden list configuration for mixed-case entries. The attacker then submits a resource containing a metadata key that the case-insensitive sort places out of byte-order position, causing the binary search to miss it. The resulting object bypasses tenant isolation controls.

text

# Security patch reference - Makefile changes from the fix commit
# Run tests
.PHONY: test
-test: test-clean generate manifests test-clean
-	@GO111MODULE=on go test -race -v $(shell go list ./... | grep -v "e2e") -coverprofile coverage.out
+test: gotestsum test-clean generate manifests test-clean
+	@GO111MODULE=on $(GOTEST) \
+		--format pkgname-and-test-fails \
+		--packages="$(shell go list ./... | grep -v "e2e")" \
+		-- \
+		-race \
+		-coverprofile coverage.out

Source: GitHub Commit 755cef5

Detection Methods for CVE-2026-61672

Indicators of Compromise

Kubernetes audit log entries showing tenant owners successfully applying metadata keys that appear in the configured ForbiddenListSpec.ExactMatch.
Creation or modification of namespaces, Services, or node metadata by tenant service accounts using labels or annotations that should be denied.
Capsule webhook admission decisions returning allowed: true for requests containing forbidden keys.

Detection Strategies

Audit all Tenant custom resources and enumerate ForbiddenListSpec.ExactMatch entries containing mixed-case keys.
Correlate Kubernetes API server audit logs with Capsule webhook responses to identify inconsistencies between declared restrictions and admitted objects.
Review network policy and scheduling changes originating from tenant namespaces for keys matching the forbidden list.

Monitoring Recommendations

Enable Kubernetes API audit logging at the Metadata level or higher for tenant-owned resources.
Alert on unexpected changes to shared cluster primitives such as node labels, cluster-scoped Services, and delegated namespace metadata.
Track the Capsule controller version deployed across clusters and flag any instance running below 0.13.7.

How to Mitigate CVE-2026-61672

Immediate Actions Required

Upgrade Capsule to version 0.13.7 or later across all Kubernetes clusters.
Normalize existing ForbiddenListSpec.ExactMatch entries to lowercase as an interim measure where byte-order and case-insensitive orderings coincide.
Review recent tenant activity for policy bypasses since the vulnerable version was deployed.

Patch Information

Project Capsule addressed this issue in release v0.13.7 via pull request #1982. See the GitHub Security Advisory GHSA-gjw4-3v3v-rqxg, the GitHub Release v0.13.7, and the fix commit 755cef5 for full details.

Workarounds

Restrict all forbidden list entries to lowercase so that case-insensitive and byte-order sortings produce identical results.
Layer an external admission controller such as Kyverno or OPA Gatekeeper to enforce the same metadata restrictions independently of Capsule.
Limit tenant owner permissions and reduce the blast radius of a bypass by scoping delegated node metadata privileges narrowly.

bash

# Upgrade Capsule via Helm to the fixed release
helm repo update projectcapsule
helm upgrade capsule projectcapsule/capsule \
  --namespace capsule-system \
  --version 0.13.7

# Verify the running controller version
kubectl -n capsule-system get deployment capsule-controller-manager \
  -o jsonpath='{.spec.template.spec.containers[0].image}'