CVE-2026-61794: Capsule Kubernetes Framework DoS Vulnerability

CVE-2026-61794 Overview

Capsule is a multi-tenancy and policy-based framework for Kubernetes. CVE-2026-61794 affects Capsule versions 0.13.0 through 0.13.6, where the Tenant update validation webhook incorrectly compiles the ForbiddenLabels.Regex expression for both labels and annotations checks. This flaw allows a tenant administrator to persist a malformed ForbiddenAnnotations.Regex while the labels expression remains valid. When namespace creation or update triggers forbidden metadata validation, regexp.MustCompile can panic and deny namespace operations for the affected tenant. The issue is fixed in version 0.13.7.

Critical Impact
A tenant administrator can store a malformed annotation regex that later causes the Capsule webhook to panic, blocking all namespace create and update operations for the tenant.

Affected Products

Capsule multi-tenancy framework version 0.13.0
Capsule versions 0.13.1 through 0.13.6
Kubernetes clusters using Capsule Tenant resources for namespace policy enforcement

Discovery Timeline

2026-09-18 - CVE-2026-61794 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-61794

Vulnerability Analysis

The flaw resides in internal/webhook/tenant/validation/forbidden_annotations_regex.go. The validation loop iterates over a map keyed by scope names (labels and annotations), but each iteration compiled tnt.Spec.NamespaceOptions.ForbiddenLabels.Regex rather than the expression tied to the current scope. The annotations regex was never validated at admission time.

Because the admission webhook accepted invalid annotation expressions, a malformed pattern could be persisted in the Tenant object. Downstream code in pkg/api/forbidden_list.go uses regexp.MustCompile, which panics on invalid input. The panic aborts the request handler and denies namespace operations for the tenant. This is classified as an improper input validation issue [CWE-20].

Root Cause

A copy-paste defect in the tenant validation webhook caused the wrong field to be evaluated. The loop used the scope label as the key but always referenced ForbiddenLabels.Regex when calling regexp.Compile, bypassing validation of the annotations expression entirely.

Attack Vector

Exploitation requires an authenticated user with permission to update a Tenant resource. The attacker submits a Tenant with a valid ForbiddenLabels.Regex and a syntactically invalid ForbiddenAnnotations.Regex. The webhook admits the object, and any subsequent namespace create or update within the tenant triggers a panic in the forbidden metadata validation path, resulting in denial of service for tenant namespace operations.

// Patch: internal/webhook/tenant/validation/forbidden_annotations_regex.go
func (h *forbiddenAnnotationsRegexHandler) validate(tnt *capsulev1beta2.Tenant, req admission.Request) *admission.Response {
    if tnt == nil || tnt.Spec.NamespaceOptions == nil {
        return nil
    }

    regexesToCheck := map[string]string{
        "labels":      tnt.Spec.NamespaceOptions.ForbiddenLabels.Regex,
        "annotations": tnt.Spec.NamespaceOptions.ForbiddenAnnotations.Regex,
    }

    for scope, expression := range regexesToCheck {
        if expression == "" {
            continue
        }

        if _, err := regexp.Compile(expression); err != nil {
            return ad.Denyf(
                "unable to compile regex %q for forbidden %s: %v",
                expression,
                scope,
                err,
            )
        }
    }
}

Source: GitHub Commit 8d89d68

Detection Methods for CVE-2026-61794

Indicators of Compromise

Tenant objects containing a ForbiddenAnnotations.Regex value that fails Go regexp.Compile validation.
Capsule controller pod logs showing panic stack traces originating in pkg/api/forbidden_list.go during namespace admission.
Failed namespace create or update events for a specific tenant with generic webhook error messages.

Detection Strategies

Audit all Capsule Tenant resources and test each spec.namespaceOptions.forbiddenAnnotations.regex value with a Go regex compiler.
Monitor the Capsule webhook deployment for repeated pod restarts or crash loops that correlate with tenant configuration changes.
Review Kubernetes audit logs for Tenant update events that modify forbiddenAnnotations.regex and correlate with subsequent namespace admission failures.

Monitoring Recommendations

Ingest Capsule webhook logs and Kubernetes audit events into a centralized logging platform and alert on runtime error or panic keywords.
Track admission webhook error rates per tenant to detect denial-of-service conditions early.
Alert on Tenant spec changes performed by non-cluster-admin identities to catch abuse of delegated tenant permissions.

How to Mitigate CVE-2026-61794

Immediate Actions Required

Upgrade Capsule to version 0.13.7 or later across all Kubernetes clusters running the affected versions.
Inventory existing Tenant resources and validate every forbiddenAnnotations.regex and forbiddenLabels.regex value against a Go regex parser.
Restrict Tenant update permissions to trusted cluster operators until the upgrade is complete.

Patch Information

The fix is available in Capsule v0.13.7. The corrective change is tracked in Pull Request #1983 and commit 8d89d68. Details are published in GitHub Security Advisory GHSA-gxjc-74v5-3vx3.

Workarounds

Remove or clear the forbiddenAnnotations.regex field from Tenant specs on affected versions to prevent panic conditions.
Enforce Kubernetes RBAC policies that limit which service accounts and users can modify Tenant resources.
Add an external admission policy (for example, OPA Gatekeeper or Kyverno) that validates regex fields on Tenant objects prior to Capsule webhook processing.

bash

# Upgrade Capsule via Helm to the patched release
helm repo update projectcapsule
helm upgrade capsule projectcapsule/capsule \
  --namespace capsule-system \
  --version 0.13.7

# Verify running version
kubectl -n capsule-system get deploy capsule-controller-manager \
  -o jsonpath='{.spec.template.spec.containers[0].image}'