CVE-2026-61794: Capsule Tenant ForbiddenAnnotations.Regex validation bypass

CVE-2026-61794 · Severity: medium · CVSS 6.8 · Published 2026-09-18

Capsule is a Kubernetes multi-tenancy management tool. An attacker with Tenant update privileges can bypass validation checks by providing a malformed regex for forbidden annotations while keeping the forbidden labels regex valid. This allows the malformed configuration to persist and later triggers denial-of-service crashes in the admission controller when namespace operations are attempted, disrupting namespace management for the affected tenant.

Technologies: github.com/projectcapsule/capsule (Go). Vendors: Go.

Quick answers

Is CVE-2026-61794 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61794 being exploited in the wild.
How severe is CVE-2026-61794?
Medium severity, with a CVSS score of 6.8, published 18 September 2026.
Which products and versions are affected?
github.com/projectcapsule/capsule (Go) >= 0.13.0, < 0.13.7, SEMVER:introduced=0.13.0,fixed=0.13.7.
Is there a fix for CVE-2026-61794?
Yes. github.com/projectcapsule/capsule (Go): upgrade to 0.13.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61794 attacked?
It is attacked over the network.
Am I affected by CVE-2026-61794?
Check whether you run github.com/projectcapsule/capsule (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/projectcapsule/capsule (Go): upgrade to 0.13.7 or later
    go get github.com/projectcapsule/capsule@v0.13.7

Technical details

The vulnerability is a validation logic error in the Tenant admission webhook (`forbidden_annotations_regex.go`). During Tenant update validation, the webhook iterates over both labels and annotations metadata fields but compiles only the `ForbiddenLabels.Regex` value for both checks—the `ForbiddenAnnotations.Regex` is never validated. An attacker with Tenant update privileges can supply an invalid regex pattern for the annotations field (e.g., `[invalid-regex(`) while keeping the labels regex valid, bypassing validation. When a namespace is later created or updated that triggers forbidden metadata validation, the admission controller calls `regexp.MustCompile()` on the malformed annotations regex via `pkg/api/forbidden_list.go`, causing a panic that crashes the admission webhook and denies service to namespace operations. The fix requires validating both the labels and annotations regex patterns independently during Tenant update.

Affected products

  • Clastix Capsule

Identifiers

  • CVE-2026-61794
  • GHSA-gxjc-74v5-3vx3
  • GO-2026-6521

Timeline

  • 2026-09-18: disclosed: GHSA advisory published
  • 2026-01-01: other: CVE-2026-61794 assigned (future/placeholder date based on advisory)

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.