Executive brief
Capsule is a tool used to manage multi-tenancy in Kubernetes clusters. A vulnerability exists where a cluster administrator can provide a malformed regular expression in the configuration settings, which causes the system to crash whenever any node in the cluster is updated or created. This results in a cluster-wide denial of service, preventing new nodes from joining, existing nodes from being maintained, or any metadata changes from being processed.
Technical details
The vulnerability is a denial-of-service (DoS) caused by a lack of input validation in the Capsule admission webhook. Specifically, the `ForbiddenLabels.Regex` and `ForbiddenAnnotations.Regex` fields in `CapsuleConfiguration` are not validated before being persisted to etcd. When a Node `CREATE`, `UPDATE`, or `PATCH` request occurs, the downstream consumer calls `regexp.MustCompile()` on these stored strings. Because `MustCompile` panics on invalid regex patterns, a malformed entry crashes the webhook process. This blocks all node-related operations cluster-wide, including autoscaling and maintenance. The issue was addressed in version 0.13.8 by adding a dedicated regex validator to the configuration webhook.
Affected products
- Project Capsule Capsule <= 0.13.7
Timeline
- 2026-07-08: disclosed
- 2026-07-31: advisory
- 2026-07-31: patched: Fixed in version 0.13.8