Executive brief
Capsule is a multi-tenancy solution for Kubernetes that manages tenant namespace isolation and policies. A bug in the hostname regex validation webhook causes it to validate the old (previous) tenant configuration instead of the new one being submitted, allowing a cluster administrator to bypass validation and store a malformed regex. Once stored, the invalid regex blocks all Ingress operations for affected tenants, causing a denial of service.
Technical details
The vulnerability is a parameter order bug in `hostnameRegexHandler.OnUpdate()` in `internal/webhook/tenant/validation/hostname_regex.go`. The method signature swaps the `tnt` (new tenant) and `old` (old tenant) parameters compared to the interface contract defined in `TypedHandler[T]`, causing the webhook to validate the old tenant's `AllowedHostnames.Regex` instead of the new one. An authenticated cluster administrator can submit an invalid (malformed) regex pattern via tenant update; the webhook validates the old valid regex and returns Allow. The malformed regex is persisted to etcd. Subsequently, ingress hostname validation calls `regexp.MatchString()` with the invalid pattern, which returns false with a silently-ignored error, causing all Ingress CREATE/UPDATE operations in the tenant to be rejected. All 11 other handlers in the same package use the correct parameter order; only this handler is affected.
Affected products
- Capsule Capsule
Timeline
- 2026-09-18: disclosed: GHSA-f94q-w3w8-cj67 published