# CVE-2026-61794: Capsule Tenant ForbiddenAnnotations.Regex validation bypass

Source: https://junglewise.ai/threats/cve-2026-61794-capsule-tenant-forbiddenannotations-regex-validation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61794 · Severity: medium · CVSS 6.8 · Published 2026-09-18

Capsule is a Kubernetes multi-tenancy management tool. An attacker with Tenant update privileges can bypass validation checks by providing a malformed regex for forbidden annotations while keeping the forbidden labels regex valid. This allows the malformed configuration to persist and later triggers denial-of-service crashes in the admission controller when namespace operations are attempted, disrupting namespace management for the affected tenant.

Technologies: [github.com/projectcapsule/capsule (Go)](https://junglewise.ai/threats/technologies/github-com-projectcapsule-capsule). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-61794 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61794 being exploited in the wild.

**How severe is CVE-2026-61794?** Medium severity, with a CVSS score of 6.8, published 18 September 2026.

**Which products and versions are affected?** github.com/projectcapsule/capsule (Go) >= 0.13.0, < 0.13.7, SEMVER:introduced=0.13.0,fixed=0.13.7.

**Is there a fix for CVE-2026-61794?** Yes. github.com/projectcapsule/capsule (Go): upgrade to 0.13.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61794 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-61794?** Check whether you run github.com/projectcapsule/capsule (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/projectcapsule/capsule (Go): upgrade to 0.13.7 or later

  ```sh
  go get github.com/projectcapsule/capsule@v0.13.7
  ```


## Technical details

The vulnerability is a validation logic error in the Tenant admission webhook (`forbidden_annotations_regex.go`). During Tenant update validation, the webhook iterates over both labels and annotations metadata fields but compiles only the `ForbiddenLabels.Regex` value for both checks—the `ForbiddenAnnotations.Regex` is never validated. An attacker with Tenant update privileges can supply an invalid regex pattern for the annotations field (e.g., `[invalid-regex(`) while keeping the labels regex valid, bypassing validation. When a namespace is later created or updated that triggers forbidden metadata validation, the admission controller calls `regexp.MustCompile()` on the malformed annotations regex via `pkg/api/forbidden_list.go`, causing a panic that crashes the admission webhook and denies service to namespace operations. The fix requires validating both the labels and annotations regex patterns independently during Tenant update.

## Affected products

- Clastix Capsule

## Identifiers

- CVE-2026-61794
- GHSA-gxjc-74v5-3vx3
- GO-2026-6521

## Timeline

- 2026-09-18: disclosed: GHSA advisory published
- 2026-01-01: other: CVE-2026-61794 assigned (future/placeholder date based on advisory)

## Related threats

- [Capsule hostnameRegexHandler parameter order bypass in webhook validation](https://junglewise.ai/threats/cve-2026-61795-capsule-hostnameregexhandler-parameter-order-bypass-in-webhook)
- [Capsule forbidden namespace/service/node label and annotation enforcement bypass](https://junglewise.ai/threats/cve-2026-61672-capsule-forbidden-namespace-service-node-label-and-annotation)
- [Clastix Capsule incorrect authorization via typo in namespaces/finalize webhook](https://junglewise.ai/threats/cve-2026-55636-clastix-capsule-incorrect-authorization-via-typo-in-namespaces)
- [Project Capsule privilege escalation in TenantResource controller](https://junglewise.ai/threats/cve-2026-65835-project-capsule-privilege-escalation-in-tenantresource-controller)
- [Project Capsule Denial of Service via malformed NodeMetadata regex](https://junglewise.ai/threats/cve-2026-65834-project-capsule-denial-of-service-via-malformed-nodemetadata)