Executive brief
capsule-proxy service discloses Namespaces of colliding tenants to owners of different tenants with the same ServiceAccount name
Affected products
- Go github.com/projectcapsule/capsule
- Go github.com/projectcapsule/capsule-proxy
Junglewise Threat Intelligence
CVE-2023-46254: capsule-proxy service discloses Namespaces of colliding tenants to owners of different tenants with the same ServiceAccount name
CVE-2023-46254 · Severity: low · CVSS 3.1 · Published 2023-11-07
Technologies: github.com/projectcapsule/capsule (Go). Vendors: Go.
Related threats
- Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/we
- Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/web
- Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_lis
- Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml
- Project Capsule privilege escalation in TenantResource controller