# CVE-2026-61795: Capsule hostnameRegexHandler parameter order bypass in webhook validation

Source: https://junglewise.ai/threats/cve-2026-61795-capsule-hostnameregexhandler-parameter-order-bypass-in-webhook  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61795 · Severity: medium · CVSS 6.8 · Published 2026-09-18

Capsule is a multi-tenancy solution for Kubernetes that manages tenant namespace isolation and policies. A bug in the hostname regex validation webhook causes it to validate the old (previous) tenant configuration instead of the new one being submitted, allowing a cluster administrator to bypass validation and store a malformed regex. Once stored, the invalid regex blocks all Ingress operations for affected tenants, causing a denial of service.

Technologies: [github.com/projectcapsule/capsule (Go)](https://junglewise.ai/threats/technologies/github-com-projectcapsule-capsule). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-61795 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61795 being exploited in the wild.

**How severe is CVE-2026-61795?** Medium severity, with a CVSS score of 6.8, published 18 September 2026.

**Which products and versions are affected?** github.com/projectcapsule/capsule (Go) >= 0.13.0, < 0.13.7, SEMVER:introduced=0.13.0,fixed=0.13.7.

**Is there a fix for CVE-2026-61795?** Yes. github.com/projectcapsule/capsule (Go): upgrade to 0.13.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61795 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-61795?** Check whether you run github.com/projectcapsule/capsule (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/projectcapsule/capsule (Go): upgrade to 0.13.7 or later

  ```sh
  go get github.com/projectcapsule/capsule@v0.13.7
  ```


## Technical details

The vulnerability is a parameter order bug in `hostnameRegexHandler.OnUpdate()` in `internal/webhook/tenant/validation/hostname_regex.go`. The method signature swaps the `tnt` (new tenant) and `old` (old tenant) parameters compared to the interface contract defined in `TypedHandler[T]`, causing the webhook to validate the old tenant's `AllowedHostnames.Regex` instead of the new one. An authenticated cluster administrator can submit an invalid (malformed) regex pattern via tenant update; the webhook validates the old valid regex and returns Allow. The malformed regex is persisted to etcd. Subsequently, ingress hostname validation calls `regexp.MatchString()` with the invalid pattern, which returns false with a silently-ignored error, causing all Ingress CREATE/UPDATE operations in the tenant to be rejected. All 11 other handlers in the same package use the correct parameter order; only this handler is affected.

## Affected products

- Capsule Capsule

## Identifiers

- CVE-2026-61795
- GHSA-f94q-w3w8-cj67
- GO-2026-6519

## Timeline

- 2026-09-18: disclosed: GHSA-f94q-w3w8-cj67 published

## Related threats

- [Capsule Tenant ForbiddenAnnotations.Regex validation bypass](https://junglewise.ai/threats/cve-2026-61794-capsule-tenant-forbiddenannotations-regex-validation-bypass)
- [Capsule forbidden namespace/service/node label and annotation enforcement bypass](https://junglewise.ai/threats/cve-2026-61672-capsule-forbidden-namespace-service-node-label-and-annotation)
- [Clastix Capsule incorrect authorization via typo in namespaces/finalize webhook](https://junglewise.ai/threats/cve-2026-55636-clastix-capsule-incorrect-authorization-via-typo-in-namespaces)
- [Project Capsule privilege escalation in TenantResource controller](https://junglewise.ai/threats/cve-2026-65835-project-capsule-privilege-escalation-in-tenantresource-controller)
- [Project Capsule Denial of Service via malformed NodeMetadata regex](https://junglewise.ai/threats/cve-2026-65834-project-capsule-denial-of-service-via-malformed-nodemetadata)