CVE-2026-61795: Capsule hostnameRegexHandler parameter order bypass in webhook validation

CVE-2026-61795 · Severity: medium · CVSS 6.8 · Published 2026-09-18

Capsule is a multi-tenancy solution for Kubernetes that manages tenant namespace isolation and policies. A bug in the hostname regex validation webhook causes it to validate the old (previous) tenant configuration instead of the new one being submitted, allowing a cluster administrator to bypass validation and store a malformed regex. Once stored, the invalid regex blocks all Ingress operations for affected tenants, causing a denial of service.

Technologies: github.com/projectcapsule/capsule (Go). Vendors: Go.

Quick answers

Is CVE-2026-61795 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61795 being exploited in the wild.
How severe is CVE-2026-61795?
Medium severity, with a CVSS score of 6.8, published 18 September 2026.
Which products and versions are affected?
github.com/projectcapsule/capsule (Go) >= 0.13.0, < 0.13.7, SEMVER:introduced=0.13.0,fixed=0.13.7.
Is there a fix for CVE-2026-61795?
Yes. github.com/projectcapsule/capsule (Go): upgrade to 0.13.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61795 attacked?
It is attacked over the network.
Am I affected by CVE-2026-61795?
Check whether you run github.com/projectcapsule/capsule (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/projectcapsule/capsule (Go): upgrade to 0.13.7 or later
    go get github.com/projectcapsule/capsule@v0.13.7

Technical details

The vulnerability is a parameter order bug in `hostnameRegexHandler.OnUpdate()` in `internal/webhook/tenant/validation/hostname_regex.go`. The method signature swaps the `tnt` (new tenant) and `old` (old tenant) parameters compared to the interface contract defined in `TypedHandler[T]`, causing the webhook to validate the old tenant's `AllowedHostnames.Regex` instead of the new one. An authenticated cluster administrator can submit an invalid (malformed) regex pattern via tenant update; the webhook validates the old valid regex and returns Allow. The malformed regex is persisted to etcd. Subsequently, ingress hostname validation calls `regexp.MatchString()` with the invalid pattern, which returns false with a silently-ignored error, causing all Ingress CREATE/UPDATE operations in the tenant to be rejected. All 11 other handlers in the same package use the correct parameter order; only this handler is affected.

Affected products

  • Capsule Capsule

Identifiers

  • CVE-2026-61795
  • GHSA-f94q-w3w8-cj67
  • GO-2026-6519

Timeline

  • 2026-09-18: disclosed: GHSA-f94q-w3w8-cj67 published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.