Executive brief
Capsule is a Kubernetes multi-tenancy management tool. An attacker with Tenant update privileges can bypass validation checks by providing a malformed regex for forbidden annotations while keeping the forbidden labels regex valid. This allows the malformed configuration to persist and later triggers denial-of-service crashes in the admission controller when namespace operations are attempted, disrupting namespace management for the affected tenant.
Technical details
The vulnerability is a validation logic error in the Tenant admission webhook (`forbidden_annotations_regex.go`). During Tenant update validation, the webhook iterates over both labels and annotations metadata fields but compiles only the `ForbiddenLabels.Regex` value for both checks—the `ForbiddenAnnotations.Regex` is never validated. An attacker with Tenant update privileges can supply an invalid regex pattern for the annotations field (e.g., `[invalid-regex(`) while keeping the labels regex valid, bypassing validation. When a namespace is later created or updated that triggers forbidden metadata validation, the admission controller calls `regexp.MustCompile()` on the malformed annotations regex via `pkg/api/forbidden_list.go`, causing a panic that crashes the admission webhook and denies service to namespace operations. The fix requires validating both the labels and annotations regex patterns independently during Tenant update.
Affected products
- Clastix Capsule
Timeline
- 2026-09-18: disclosed: GHSA advisory published
- 2026-01-01: other: CVE-2026-61794 assigned (future/placeholder date based on advisory)