{"id":"EUVD-2026-83055","revision":"76e89409eb42432e896a9b8f5cde0a52","records":[{"revision":"76e89409eb42432e896a9b8f5cde0a52","observedAt":"2026-10-28T08:39:17.145+00:00","statement":{"source":"euvd","id":"EUVD-2026-83055","aliases":["CVE-2026-61794","GHSA-gxjc-74v5-3vx3"],"title":"Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the la…","description":"Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","score":6.8,"severity":null}],"references":["https://github.com/projectcapsule/capsule/security/advisories/GHSA-gxjc-74v5-3vx3","https://github.com/projectcapsule/capsule/pull/1983","https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e","https://github.com/projectcapsule/capsule/releases/tag/v0.13.7"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-83055","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 18, 2026, 4:26:18 PM","dateUpdated":"Sep 22, 2026, 2:55:27 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-83055","identifiers":["EUVD-2026-83055","CVE-2026-61794","GHSA-gxjc-74v5-3vx3"]},"retained":false,"historicalAffected":[]}],"coverage":[]}