CVE-2026-55636: Clastix Capsule incorrect authorization via typo in namespaces/finalize webhook

Executive brief

Capsule, a multi-tenancy tool for Kubernetes, contains a configuration error that allows users with specific permissions to bypass security restrictions. Due to a typo in the software's validation rules, an attacker could modify protected labels on a namespace, potentially leading to a takeover of tenant resources. This bypasses intended isolation between different users or departments sharing the same cluster.

Technical details

An incorrect authorization vulnerability exists in Capsule due to a singular/plural typo in the validating webhook configuration. Specifically, the rule uses 'namespace/finalize' instead of the required plural 'namespaces/finalize'. Because Kubernetes admission webhooks match against plural resource names, this typo causes the webhook to ignore requests to the finalize subresource. An attacker with 'namespaces/finalize' RBAC permissions can exploit this to modify namespace labels, such as 'capsule.clastix.io/tenant', bypassing the intended security logic. This issue is an incomplete fix for a previous vulnerability (CVE-2026-30963) and is resolved in version 0.13.6.

Affected products

• Clastix Capsule >= 0.13.0, < 0.13.6

Timeline

• 2026-06-17: advisory: GHSA-gwxr-7h77-7777 published
• 2026-06-17: patched: Fixed in version 0.13.6

References

• https://api.github.com/users/character-s
• https://github.com/character-s
• https://api.github.com/users/character-s/gists%7B/gist_id%7D
• https://api.github.com/users/character-s/repos
• https://avatars.githubusercontent.com/u/45820854?v=4
• https://api.github.com/users/character-s/events%7B/privacy%7D