{"id":"GO-2026-6521","revision":null,"records":[{"revision":"1b98759af7af4d0e9fd905db8a68310b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-61794","aliases":[],"title":"Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic","description":"Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.","state":0,"publishedAt":"2026-09-18T16:26:18.669+00:00","modifiedAt":"2026-09-22T14:55:27.246+00:00","affected":[{"ecosystem":"Vendor product","name":"capsule","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"projectcapsule\",\n                    \"product\": \"capsule\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.13.0, < 0.13.7\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","score":6.8,"severity":"MEDIUM"}],"references":["https://github.com/projectcapsule/capsule/security/advisories/GHSA-gxjc-74v5-3vx3","https://github.com/projectcapsule/capsule/pull/1983","https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e","https://github.com/projectcapsule/capsule/releases/tag/v0.13.7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-61794","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-61794","identifiers":["CVE-2026-61794"]},"retained":false,"historicalAffected":[]},{"revision":"684051c2599f4aa8a32150595fba7879","observedAt":"2026-11-11T15:03:12.382+00:00","statement":{"source":"euvd","id":"EUVD-2026-83055","aliases":["CVE-2026-61794","GHSA-gxjc-74v5-3vx3"],"title":"Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the la…","description":"Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","score":6.8,"severity":null}],"references":["https://github.com/projectcapsule/capsule/security/advisories/GHSA-gxjc-74v5-3vx3","https://github.com/projectcapsule/capsule/pull/1983","https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e","https://github.com/projectcapsule/capsule/releases/tag/v0.13.7"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-83055","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 18, 2026, 4:26:18 PM","dateUpdated":"Sep 22, 2026, 2:55:27 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-83055","identifiers":["EUVD-2026-83055","CVE-2026-61794","GHSA-gxjc-74v5-3vx3"]},"retained":false,"historicalAffected":[]},{"revision":"f537a33a1a9f4942a354b47c3662078e","observedAt":"2026-10-25T14:19:28.838+00:00","statement":{"source":"nvd","id":"CVE-2026-61794","aliases":[],"title":"Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the la…","description":"Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.","state":0,"publishedAt":"2026-09-18T17:16:58.7+00:00","modifiedAt":"2026-09-24T21:25:27.05+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","score":6.8,"severity":"MEDIUM"}],"references":["https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e","https://github.com/projectcapsule/capsule/pull/1983","https://github.com/projectcapsule/capsule/releases/tag/v0.13.7","https://github.com/projectcapsule/capsule/security/advisories/GHSA-gxjc-74v5-3vx3"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61794","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-20"],"productCriteria":[],"sourceDates":{"published":"2026-09-18T17:16:58.700","lastModified":"2026-09-24T21:25:27.050"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-61794","identifiers":["CVE-2026-61794"]},"retained":false,"historicalAffected":[]},{"revision":"636fe65a7c9e4f5fad1c6d60195311ba","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-gxjc-74v5-3vx3","aliases":["CVE-2026-61794","GO-2026-6521"],"title":"Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic","description":"### Summary\nA validation bug in `internal/webhook/tenant/validation/forbidden_annotations_regex.go` allows an invalid `ForbiddenAnnotations.Regex` value to bypass Tenant admission on update. The webhook compiles `ForbiddenLabels.Regex` for both labels and annotations, so a malformed annotations regex can be persisted. Once stored, namespace admission later evaluates the bad regex through `pkg/api/forbidden_list.go`, where `regexp.MustCompile` can panic and cause admission failure.\n\n### Details\nIn `internal/webhook/tenant/validation/forbidden_annotations_regex.go`, `OnUpdate` validates the new Tenant object, but the loop compiles `tnt.Spec.NamespaceOptions.ForbiddenLabels.Regex` for both `labels` and `annotations`. That means an invalid `ForbiddenAnnotations.Regex` is never validated if `ForbiddenLabels.Regex` is valid.\n\nRelevant paths:\n- `internal/webhook/tenant/validation/forbidden_annotations_regex.go`\n- `internal/webhook/namespace/validation/user_metadata.go`\n- `pkg/api/forbidden_list.go`\n\nNamespace admission later calls `api.ValidateForbidden(...)`, and `ForbiddenListSpec.RegexMatch()` uses `regexp.MustCompile(in.Regex)`. If the malformed regex is present in the Tenant spec, any namespace request that reaches this check can panic or fail hard, causing denial of service for namespace operations in the affected tenant.\n\n\n### PoC\n1. Update a Tenant so that:\n   - `spec.namespaceOptions.forbiddenLabels.regex` is valid\n   - `spec.namespaceOptions.forbiddenAnnotations.regex` is malformed, for example: `[invalid-regex(`\n2. The Tenant update is accepted because the webhook compiles the labels regex for both fields.\n3. Create or update a Namespace that triggers forbidden metadata validation.\n4. The namespace admission path reaches `regexp.MustCompile(...)` and panics.\n\n```\npackage main\n\nimport (\n\t\"fmt\"\n\t\"regexp\"\n)\n\ntype ForbiddenListSpec struct {\n\tRegex string\n}\n\ntype NamespaceOptions struct {\n\tForbiddenLabels      ForbiddenListSpec\n\tForbiddenAnnotations ForbiddenListSpec\n}\n\ntype Tenant struct {\n\tNamespaceOptions *NamespaceOptions\n}\n\nfunc validateTenantUpdate(tnt *Tenant) error {\n\tif tnt.NamespaceOptions == nil {\n\t\treturn nil\n\t}\n\n\tannotationsToCheck := map[string]string{\n\t\t\"labels\":      tnt.NamespaceOptions.ForbiddenLabels.Regex,\n\t\t\"annotations\": tnt.NamespaceOptions.ForbiddenAnnotations.Regex,\n\t}\n\n\tfor scope, annotation := range annotationsToCheck {\n\t\tif _, err := regexp.Compile(tnt.NamespaceOptions.ForbiddenLabels.Regex); err != nil {\n\t\t\treturn fmt.Errorf(\"deny update: unable to compile %s regex for forbidden %s\", annotation, scope)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc validateForbidden(metadata map[string]string, forbidden ForbiddenListSpec) error {\n\tfor key := range metadata {\n\t\tif forbidden.Regex != \"\" {\n\t\t\tif regexp.MustCompile(forbidden.Regex).MatchString(key) {\n\t\t\t\treturn fmt.Errorf(\"forbidden key matched: %s\", key)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc main() {\n\toldTenant := &Tenant{\n\t\tNamespaceOptions: &NamespaceOptions{\n\t\t\tForbiddenLabels:      ForbiddenListSpec{Regex: `^[a-z0-9-]+$`},\n\t\t\tForbiddenAnnotations: ForbiddenListSpec{Regex: `^[a-z0-9-]+$`},\n\t\t},\n\t}\n\n\tnewTenant := &Tenant{\n\t\tNamespaceOptions: &NamespaceOptions{\n\t\t\tForbiddenLabels:      ForbiddenListSpec{Regex: `^[a-z0-9-]+$`},\n\t\t\tForbiddenAnnotations: ForbiddenListSpec{Regex: `[invalid-regex(`},\n\t\t},\n\t}\n\n\tfmt.Println(\"=== Update step ===\")\n\tif err := validateTenantUpdate(newTenant); err != nil {\n\t\tfmt.Printf(\"unexpected deny: %v\\n\", err)\n\t} else {\n\t\tfmt.Println(\"allowed: malformed ForbiddenAnnotations.Regex bypassed validation\")\n\t}\n\n\tfmt.Println()\n\tfmt.Println(\"=== Namespace step ===\")\n\t_ = oldTenant\n\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\tfmt.Printf(\"panic reproduced from ValidateForbidden: %v\\n\", r)\n\t\t}\n\t}()\n\n\t_ = validateForbidden(map[string]string{\"example\": \"value\"}, ForbiddenListSpec{Regex: `[invalid-regex(`})\n\tfmt.Println(\"no panic, unexpected\")\n}\n```\nExpected output:\n\n```text\n=== Update step ===\nallowed: malformed ForbiddenAnnotations.Regex bypassed validation\n\n=== Namespace step ===\npanic reproduced from ValidateForbidden: regexp: Compile(`[invalid-regex(`): error parsing regexp: missing closing ]: `[invalid-regex(`\n```\n\n\n\n### Impact\nAn attacker who can update the Tenant configuration can persist a malformed `ForbiddenAnnotations.Regex` and cause namespace admission failures for the affected tenant. This can result in a tenant-scoped denial of service.","state":0,"publishedAt":"2026-09-18T17:14:26+00:00","modifiedAt":"2026-09-28T17:11:19.835452+00:00","affected":[{"ecosystem":"Go","name":"github.com/projectcapsule/capsule","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.13.0"},{"kind":"fixed","version":"0.13.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/projectcapsule/capsule/security/advisories/GHSA-gxjc-74v5-3vx3","https://github.com/projectcapsule/capsule/pull/1983","https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e","https://github.com/projectcapsule/capsule","https://github.com/projectcapsule/capsule/releases/tag/v0.13.7"],"sourceUrl":"https://github.com/advisories/GHSA-gxjc-74v5-3vx3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-gxjc-74v5-3vx3","identifiers":["GHSA-gxjc-74v5-3vx3","CVE-2026-61794","GO-2026-6521"]},"retained":false,"historicalAffected":[]},{"revision":"4b1aff9b392f431d8966ed867c1539f4","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6521","aliases":["CVE-2026-61794","GHSA-gxjc-74v5-3vx3"],"title":"Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule","description":"Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule","state":0,"publishedAt":"2026-09-28T16:43:40+00:00","modifiedAt":"2026-09-28T17:00:17.3532468+00:00","affected":[{"ecosystem":"Go","name":"github.com/projectcapsule/capsule","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.13.0"},{"kind":"fixed","version":"0.13.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/projectcapsule/capsule/security/advisories/GHSA-gxjc-74v5-3vx3","https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e","https://github.com/projectcapsule/capsule/pull/1983","https://github.com/projectcapsule/capsule/releases/tag/v0.13.7"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6521","license":"OSV · upstream source license applies","key":"osv:GO-2026-6521","identifiers":["GO-2026-6521","CVE-2026-61794","GHSA-gxjc-74v5-3vx3"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T07:54:58.2349119+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T07:54:58.2349119+00:00","lastSuccessAt":"2026-11-12T07:54:58.4848198+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:58.4848225+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-1225a640a70b576ed1a85d2671a302d70a8e18168f570c1f4912faf8f66b1119","complete":true,"records":424623,"lastAttemptAt":"2026-11-12T07:53:22.876714+00:00","lastSuccessAt":"2026-11-12T07:53:22.8444514+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:53:22.876714+00:00","snapshotPublishedAt":"2026-11-12T07:24:53+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-570328139368428ca550af1570d01579","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T07:55:38.9446123+00:00","lastSuccessAt":"2026-11-12T06:55:06.923+00:00","error":null,"lastVerifiedAt":"2026-11-12T06:55:06.923+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T07:54:58.2349119+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T07:54:58.2349119+00:00","lastSuccessAt":"2026-11-12T07:54:58.4862124+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:58.4862143+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8017f5c1a44c430b920cd4f30d507e78","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T07:55:38.3687422+00:00","lastSuccessAt":"2026-11-12T07:55:38.365+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:55:38.365+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T07:54:58.021445+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:58.021445+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T07:53:23.1198989+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:53:23.1198989+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-12T07:54:58.1995224+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:58.1995224+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-3c15e3b4b3da393566ac7be69c095bef52c252ec437d24c4c6ea68ed9e4af0f5","complete":true,"records":231700,"lastAttemptAt":"2026-11-12T07:54:57.8931777+00:00","lastSuccessAt":"2026-11-12T07:54:56.4668314+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:57.8931777+00:00","snapshotPublishedAt":"2026-11-12T07:33:19+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}