CVE-2026-61795 in Capsule
Summary
by MITRE • 09/18/2026
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within the Capsule Kubernetes multi-tenancy framework stems from a logical error in the webhook validation logic responsible for processing updates to Tenant resources. Specifically, during versions ranging from 0.13.0 through 0.13.7, the hostnameRegexHandler.OnUpdate function contains a critical parameter swapping defect where the new and old Tenant objects are reversed during the comparison process. This implementation flaw causes the system to validate the previously stored AllowedHostnames.Regex value rather than evaluating the newly submitted configuration proposed by the user or administrator. Consequently, if an existing tenant had a valid regular expression pattern configured prior to the update attempt, the webhook erroneously accepts the new request even when it contains a malformed or syntactically incorrect regex string for allowed hostnames. This results in the persistence of invalid configuration data within the cluster state because the admission control mechanism fails to reject the bad input based on its own structural integrity checks.
The operational impact of this vulnerability is significant, primarily manifesting as a denial-of-service condition for specific tenants rather than a security breach or privilege escalation. Once the malformed AllowedHostnames.Regex is stored in the Kubernetes API server due to the flawed validation logic, subsequent operations involving Ingress resources are severely disrupted. When an attempt is made to create or update an Ingress object that relies on hostname matching against this tenant configuration, the system invokes validate_hostnames.go which attempts to compile and execute the malformed regular expression. Instead of raising a clear error indicating invalid syntax, the validation logic silently ignores the regex compilation failure and defaults to treating every incoming hostname as unmatched. This behavior effectively blocks all Ingress operations for the affected tenant because no hostnames can successfully match against an empty or failed pattern set, rendering the web application inaccessible through standard ingress routing mechanisms until manual intervention occurs.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-841 Improvement of Incorrectness Checks, as the system fails to properly validate user-supplied input before persisting it to state storage. The attack vector is classified under MITRE ATT&CK technique T1530 Data from Information Repositories if an attacker can manipulate tenant configurations via compromised credentials or misconfigured RBAC policies, although in this specific context, the primary risk stems from administrative error facilitated by weak validation controls rather than external exploitation. The flaw highlights a common pitfall in webhook development where state consistency and parameter ordering are not rigorously enforced during update operations.
To mitigate this vulnerability, organizations running Capsule versions prior to 0.13.7 must upgrade immediately to version 0.13.7 or later, which corrects the parameter reversal logic within the hostnameRegexHandler.OnUpdate function. For clusters that cannot be upgraded instantly due to operational constraints, administrators should audit existing Tenant resources for any recently modified AllowedHostnames.Regex fields and manually verify their syntax using standard regular expression testing tools before allowing further Ingress operations. Implementing stricter RBAC policies can also limit which users are permitted to modify tenant configurations, thereby reducing the surface area for accidental or malicious introduction of malformed patterns. Regular validation of webhook logic against edge cases involving invalid inputs is recommended as a best practice in Kubernetes admission controller development to prevent similar logical errors from persisting into production environments.