https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:56:21.102582+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-9768 EUVD-2026-9768 2026-10-04T00:56:21.105857+00:00 EUVD-2026-9768 https://cve.radiocsirt.org/vuln/fkie_cve-2023-46254 fkie_cve-2023-46254 2026-10-04T00:56:21.105916+00:00

capsule-proxy is a reverse proxy for Capsule kubernetes multi-tenancy framework. A bug in the RoleBinding reflector used by `capsule-proxy` gives ServiceAccount tenant owners the right to list Namespaces of other tenants backed by the same owner kind and name. For example consider two tenants `solar` and `wind`. Tenant `solar`, owned by a ServiceAccount named `tenant-owner` in the Namespace `solar`. Tenant `wind`, owned by a ServiceAccount named `tenant-owner` in the Namespace `wind`. The Tenant owner `solar` would be able to list the namespaces of the Tenant `wind` and vice-versa, although this is not correct. The bug introduces an exfiltration vulnerability since allows the listing of Namespace resources of other Tenants, although just in some specific conditions: 1. `capsule-proxy` runs with the `--disable-caching=false` (default value: `false`) and 2. Tenant owners are ServiceAccount, with the same resource name, but in different Namespaces. This vulnerability doesn't allow any privilege escalation on the outer tenant Namespace-scoped resources, since the Kubernetes RBAC is enforcing this. This issue has been addressed in version 0.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-6758-979h-249x GHSA-6758-979h-249x — capsule-proxy service discloses Namespaces of colliding tenants to owners of different tenants with the same ServiceAcc… 2026-10-04T00:56:21.105977+00:00

Affected: Go: github.com/projectcapsule/capsule, Go: github.com/projectcapsule/capsule-proxy

### Summary

A bug in the RoleBinding reflector used by `capsule-proxy` gives ServiceAccount tenant owners the right to list Namespaces of other tenants backed by the same owner kind and name.

### Details

- Tenant `solar`, owned by a ServiceAccount named `tenant-owner` in the Namespace `solar` - Tenant `wind`, owned by a ServiceAccount named `tenant-owner` in the Namespace `wind`

> Please, notice the same ServiceAccount name, although in different namespaces.

The Tenant owner `solar` would be able to list the namespaces of the Tenant `wind` and vice-versa, although this is not correct.

The bug introduces an exfiltration vulnerability since allows the listing of Namespace resources of other Tenants, although just in some specific conditions:

1. `capsule-proxy` runs with the `--disable-caching=false` (default value: `false`) 2. Tenant owners are ServiceAccount, with the same resource name, but in different Namespaces.

The CVE doesn't allow any privilege escalation on the outer tenant Namespace-scoped resources, since the Kubernetes RBAC is enforcing this.

 https://cve.radiocsirt.org/vuln/gsd-2023-46254 gsd-2023-46254 2026-10-04T00:56:21.106037+00:00 gsd-2023-46254