Malformed Regex Vulnerability in Capsule for Kubernetes by Project Capsule
CVE-2026-65834

6.8MEDIUM

Key Information:

Vendor

Projectcapsule

Status
Capsule
Vendor
CVE Published:
30 July 2026

What is CVE-2026-65834?

Prior to version 0.13.8, Capsule, a multi-tenancy and policy-based framework for Kubernetes, had a significant flaw where the Kubernetes configuration admission webhook did not validate certain regex patterns set within CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex. This flaw allowed a Cluster Admin to inadvertently store a malformed regex, which then led to a crash of the node admission webhook during node create, update, or patch operations. The issue has been resolved in the latest release, version 0.13.8.

Affected Version(s)

capsule < 0.13.8

References

https://github.com/projectcapsule/capsule/security/adviso...
x_refsource_CONFIRM
https://github.com/projectcapsule/capsule/releases/tag/v0...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.