CVE-2026-61794
Gravedad CVSS v3.1:
MEDIA
Tipo:
CWE-20
Validación incorrecta de entrada
Fecha de publicación:
18/09/2026
Última modificación:
24/09/2026
Descripción
*** Pendiente de traducción *** Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.
Impacto
Puntuación base 3.x
6.80
Gravedad 3.x
MEDIA
Referencias a soluciones, herramientas e información
- https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e
- https://github.com/projectcapsule/capsule/pull/1983
- https://github.com/projectcapsule/capsule/releases/tag/v0.13.7
- https://github.com/projectcapsule/capsule/security/advisories/GHSA-gxjc-74v5-3vx3
- https://github.com/projectcapsule/capsule/security/advisories/GHSA-gxjc-74v5-3vx3