Kubernetes Multi-tenancy Framework Capsule Vulnerability
CVE-2026-61794

6.8MEDIUM

Key Information:

Vendor

Projectcapsule

Status
Capsule
Vendor
CVE Published:
18 September 2026

What is CVE-2026-61794?

A flaw in Capsule, a multi-tenancy and policy-based framework for Kubernetes, allows an administrator to persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid during Tenant updates. This improper input validation can lead to namespace creation or update failures, as the stored expression may cause panic during forbidden metadata validation, affecting operations for the tenant. The issue has been addressed in version 0.13.7.

Affected Version(s)

capsule >= 0.13.0, < 0.13.7

References

https://github.com/projectcapsule/capsule/security/adviso...
x_refsource_CONFIRM
https://github.com/projectcapsule/capsule/pull/1983
x_refsource_MISC
https://github.com/projectcapsule/capsule/commit/8d89d686...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.