Executive brief
Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule
Affected products
- Go github.com/projectcapsule/capsule
Junglewise Threat Intelligence
CVE-2025-55205: GO-2025-3893 - Capsule tenant owners with "patch namespace" permission can hijack system namespaces label in github.com/projectcapsule/capsule
CVE-2025-55205 · Severity: low · CVSS 3.1 · Published 2025-08-29
Technologies: github.com/projectcapsule/capsule (Go). Vendors: Go.
Related threats
- Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/we
- Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/web
- Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_lis
- Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml
- Project Capsule privilege escalation in TenantResource controller