CVE-2026-65834 in Capsule
Summary
by MITRE • 07/30/2026
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster Admin to store a malformed regex that later reached regexp.MustCompile in pkg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and crashed the node admission webhook on Node create, update, or patch requests. This issue is fixed in version 0.13.8.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability described represents a critical input validation flaw in the Capsule Kubernetes framework that affects multi-tenant cluster management capabilities. This issue specifically targets the configuration admission webhook component responsible for enforcing node metadata restrictions through forbidden labels and annotations regex patterns. The flaw exists in versions prior to 0.13.8 where the system fails to validate user-provided regular expressions before storing them in the CapsuleConfiguration specification, creating a path for malformed regex patterns to propagate through the system architecture.
The technical execution of this vulnerability occurs when a cluster administrator creates or modifies a CapsuleConfiguration resource that includes invalid regular expression patterns in either the ForbiddenLabels.Regex or ForbiddenAnnotations.Regex fields. These malformed patterns bypass initial validation checks within the configuration admission webhook, allowing them to be persisted in the system configuration. When subsequent node operations occur such as create, update, or patch requests, the stored malformed regex patterns are processed by regexp.MustCompile function located in pkg/api/forbidden_list.go. This function call triggers a panic condition that crashes the entire node admission webhook service, effectively rendering the cluster unable to process any node-related operations until the webhook is manually restarted or the invalid configuration is removed.
The operational impact of this vulnerability extends beyond simple service disruption to represent a potential denial-of-service attack vector that could be exploited by malicious actors within privileged roles. The crash affects the core admission control mechanism of Kubernetes clusters using Capsule, preventing legitimate node operations from completing successfully and potentially compromising cluster stability. This vulnerability directly maps to CWE-134 Uncontrolled Format String which describes the risk of executing arbitrary code through improper input handling in format strings or regular expression processing. From an ATT&CK perspective, this represents a privilege escalation opportunity through lateral movement within the cluster management plane, as it requires only cluster admin credentials to exploit.
The remediation strategy involves upgrading to Capsule version 0.13.8 or later where proper validation of regex patterns has been implemented in the configuration admission webhook. This fix ensures that all user-provided regular expressions undergo proper validation before being stored, preventing malformed patterns from reaching the regexp.MustCompile function. Organizations should also implement monitoring and alerting for admission webhook crashes to detect potential exploitation attempts, while maintaining regular security audits of cluster configurations to identify any improperly validated regex patterns that may have already been deployed in production environments.