projectcapsule/capsule Security Advisories | GitStock

medium2026-09-18

Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation

GHSA-f94q-w3w8-cj67 · CVE-2026-61795

high2026-09-18

Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

GHSA-gjw4-3v3v-rqxg · CVE-2026-61672

medium2026-09-18

Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic

GHSA-gxjc-74v5-3vx3 · CVE-2026-61794

medium2026-07-31

Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

GHSA-jr6p-8pjj-mfx6 · CVE-2026-65835

medium2026-07-31

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

GHSA-68cj-mvg9-rgm2 · CVE-2026-65834

medium2026-06-17

Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

GHSA-gwxr-7h77-7777 · CVE-2026-55636

medium2026-05-28

Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

GHSA-qjjm-7j9w-pw72 · CVE-2026-22872

low2026-05-28

Capsule Namespace Hijacking via subresource

GHSA-2ww6-hf35-mfjm · CVE-2026-30963

critical2025-08-18

Capsule tenant owners with "patch namespace" permission can hijack system namespaces label

GHSA-fcpm-6mxq-m5vv · CVE-2025-55205

high2024-08-20

Capsule tenant owner with "patch namespace" permission can hijack system namespaces

GHSA-mq69-4j5w-3qwp · CVE-2024-39690