CVE-2026-61795: Capsule Kubernetes Validation Bypass Flaw

CVE-2026-61795 Overview

Capsule is a multi-tenancy and policy-based framework for Kubernetes. The vulnerability affects versions 0.13.0 through 0.13.6 in the hostnameRegexHandler.OnUpdate function located in internal/webhook/tenant/validation/hostname_regex.go. The handler reverses the new and old Tenant parameters during validation, causing the webhook to validate the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can store a malformed regex that bypasses validation. Once persisted, subsequent Ingress creation or update operations fail because the tenant's Ingress validator cannot compile the pattern and treats every hostname as unmatched.

Critical Impact
A tenant with a stored malformed AllowedHostnames.Regex cannot create or update Ingress resources until an administrator manually repairs the Tenant configuration, resulting in denial of service for tenant workloads.

Affected Products

Capsule versions 0.13.0 through 0.13.6
Kubernetes clusters using Capsule for multi-tenancy
Tenant namespaces relying on Capsule webhook validation

Discovery Timeline

2026-09-18 - CVE-2026-61795 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-61795

Vulnerability Analysis

The flaw resides in the admission webhook responsible for validating Tenant updates. The OnUpdate handler in hostname_regex.go receives both the previous and current Tenant objects but swaps their positions when passing them to the validation logic. As a result, the webhook compiles and evaluates the AllowedHostnames.Regex from the stored (old) Tenant rather than the incoming submission. Because the prior state was already known-valid, the webhook admits the update and persists the malformed regex.

The downstream effect occurs in validate_hostnames.go during Ingress admission. That handler attempts to compile the stored regex, discards the compilation error, and treats the compilation result as a non-matching pattern. Every hostname submitted for the tenant fails validation, blocking Ingress operations. This weakness is classified under [CWE-697: Incorrect Comparison].

Root Cause

The root cause is a parameter ordering defect in the update handler signature combined with silent error handling in the Ingress hostname validator. The webhook trusts the wrong Tenant object during validation, and the Ingress validator suppresses regex compilation errors instead of surfacing them.

Attack Vector

Exploitation requires cluster-administrator privileges on the Kubernetes API server to submit a Tenant update. An administrator with high privileges can push a Tenant containing an invalid regex through the webhook. The scope changes to affected tenant namespaces, where users lose the ability to manage Ingress resources.

// Patch: internal/webhook/tenant/validation/hostname_regex.go
// Source: https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e
func (h *hostnameRegexHandler) OnUpdate(
	_ client.Client,
	_ client.Reader,
-	old *capsulev1beta2.Tenant,
 	tnt *capsulev1beta2.Tenant,
+	_ *capsulev1beta2.Tenant,
 	decoder admission.Decoder,
 	_ events.EventRecorder,
) handlers.Func {

The fix removes the reversed parameter and validates the submitted Tenant (tnt). A companion patch in forbidden_annotations_regex.go also corrects regex compilation error handling and adds a nil check.

Detection Methods for CVE-2026-61795

Indicators of Compromise

Tenant objects containing syntactically invalid spec.ingressOptions.allowedHostnames.allowedRegex values.
Ingress admission failures across a tenant namespace citing hostname validation errors after a recent Tenant update.
Audit-log entries showing Tenant updates accepted despite malformed regex payloads.

Detection Strategies

Query the Kubernetes API for all Tenant resources and compile each AllowedHostnames.Regex value externally to identify malformed patterns.
Correlate Capsule webhook logs with capsule-controller-manager events to find silent acceptance of invalid regex updates.
Monitor Ingress admission-denial rates per tenant for sudden increases following Tenant configuration changes.

Monitoring Recommendations

Enable Kubernetes audit logging for tenants.capsule.clastix.io update verbs and forward events to a centralized log store.
Alert on repeated Ingress creation failures scoped to a single tenant namespace.
Track the running Capsule controller image version and flag deployments below v0.13.7.

How to Mitigate CVE-2026-61795

Immediate Actions Required

Upgrade Capsule to version 0.13.7 or later on all clusters running affected versions.
Audit existing Tenant resources for malformed AllowedHostnames.Regex values and correct them manually.
Restrict cluster-administrator credentials capable of modifying Tenant resources through Kubernetes role-based access control.

Patch Information

The issue is resolved in Capsule v0.13.7. The fix is delivered through pull request #1983 and commit 8d89d68. Refer to the GitHub Security Advisory GHSA-f94q-w3w8-cj67 and the v0.13.7 release notes for details.

Workarounds

Validate AllowedHostnames.Regex values out-of-band before applying Tenant updates.
Implement an external admission policy (for example, using Kyverno or OPA/Gatekeeper) that compiles the regex before allowing Tenant writes.
Limit which principals can update Tenant resources to reduce the operational blast radius until the patch is deployed.

bash

# Upgrade Capsule via Helm to the patched release
helm repo update projectcapsule
helm upgrade capsule projectcapsule/capsule \
  --namespace capsule-system \
  --version 0.13.7

# Verify the running controller version
kubectl -n capsule-system get deployment capsule-controller-manager \
  -o jsonpath='{.spec.template.spec.containers[0].image}'