https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T12:54:06.993235+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-250095 EUVD-2026-250095 2026-10-06T12:54:07.041408+00:00 EUVD-2026-250095 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55205 fkie_cve-2025-55205 2026-10-06T12:54:07.041449+00:00

Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially accessing cross-tenant resources through TenantResource selectors. This vulnerability enables privilege escalation and violates the fundamental security boundaries that Capsule is designed to enforce. This vulnerability is fixed in 0.10.4.

 https://cve.radiocsirt.org/vuln/ghsa-fcpm-6mxq-m5vv GHSA-fcpm-6mxq-m5vv — Capsule tenant owners with "patch namespace" permission can hijack system namespaces label 2026-10-06T12:54:07.041492+00:00

Affected: Go: github.com/projectcapsule/capsule

### Summary A namespace label injection vulnerability in Capsule v0.10.3 allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially accessing cross-tenant resources through TenantResource selectors. This vulnerability enables privilege escalation and violates the fundamental security boundaries that Capsule is designed to enforce.

### Details The vulnerability exists in the namespace validation webhook logic located in `pkg/webhook/namespace/validation/patch.go:60-77`. The critical flaw is in the conditional check that only validates tenant ownership when a namespace already has a tenant label:

```go if label, ok := ns.Labels[ln]; ok { // Only checks permissions when namespace has tenant label if !utils.IsTenantOwner(tnt.Spec.Owners, req.UserInfo) { response := admission.Denied(e) return &response } }

return nil // Critical issue: allows operation if no tenant label exists ```

**Root Cause Analysis:** 1. **Missing Default Protection**: System namespaces (kube-system, default, capsule-system) do not have the `capsule.clastix.io/tenant` label by default 2. **Bypass Logic**: The webhook only enforces tenant ownership validation when the target namespace already belongs to a tenant 3. **Unrestricted Label Injection**: Authenticated users can inject arbitrary labels into unprotected namespaces

**Attack Vector Path:** ``` Label Injecti…