Capsule v0.7.0 and earlier vulnerability: Unauthorized namespace takeover

CVE-2024-39690

What is CVE-2024-39690?

Capsule, a framework designed to enable multi-tenancy within Kubernetes environments, contains a vulnerability that affects versions 0.7.0 and earlier. This issue arises when a tenant-owner can manipulate any namespace that lacks a designated owner, essentially allowing unauthorized access and control over those resources. The potential for abuse of this functionality poses significant risks, particularly in shared environments where multiple tenant-owners interact. Organizations utilizing Capsule should assess their use of affected versions and take necessary precautions to safeguard their Kubernetes deployments.

References