projectcapsule capsule vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20251
3. 20268

Newest CVEs

• CVE-2026-61795

  Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation

  projectcapsule · capsule

  Medium6.8
• CVE-2026-61672

  Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

  projectcapsule · capsule

  High7.1
• CVE-2026-61794

  Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic

  projectcapsule · capsule

  Medium6.8
• CVE-2026-55636

  Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

  projectcapsule · capsule

  Medium5.7
• CVE-2026-65835

  Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

  projectcapsule · capsule

  Medium6.6
• CVE-2026-65834

  Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

  projectcapsule · capsule

  Medium6.8
• CVE-2026-30963

  Capsule Namespace Hijacking via subresource

  projectcapsule · capsule

  Low3.9
• CVE-2026-22872

  Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

  projectcapsule · capsule

  Medium6.9
• CVE-2025-55205

  Capsule tenant owners with "patch namespace" permission can hijack system namespaces label

  projectcapsule · capsule

  Critical9.1
• CVE-2024-39690

  Capsule tenant owner with "patch namespace" permission can hijack system namespaces

  projectcapsule · capsule

  High8.5