https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:55:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-250095 EUVD-2026-250095 https://cve.radiocsirt.org/vuln/euvd-2026-250095 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55205 <p>Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially accessing cross-tenant resources through TenantResource selectors. This vulnerability enables privilege escalation and violates the fundamental security boundaries that Capsule is designed to enforce. This vulnerability is fixed in 0.10.4.</p> <p>Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially accessing cross-tenant resources through TenantResource selectors. This vulnerability enables privilege escalation and violates the fundamental security boundaries that Capsule is designed to enforce. This vulnerability is fixed in 0.10.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-55205 https://cve.radiocsirt.org/vuln/ghsa-fcpm-6mxq-m5vv <p><strong>Affected:</strong> Go: github.com/projectcapsule/capsule</p> <p>### Summary A namespace label injection vulnerability in Capsule v0.10.3 allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially accessing cross-tenant resources through TenantResource selectors. This vulnerability enables privilege escalation and violates the fundamental security boundaries that Capsule is designed to enforce.</p> <p>### Details The vulnerability exists in the namespace validation webhook logic located in `pkg/webhook/namespace/validation/patch.go:60-77`. The critical flaw is in the conditional check that only validates tenant ownership when a namespace already has a tenant label:</p> <p>```go if label, ok := ns.Labels[ln]; ok { // Only checks permissions when namespace has tenant label if !utils.IsTenantOwner(tnt.Spec.Owners, req.UserInfo) { response := admission.Denied(e) return &amp;response } }</p> <p>return nil // Critical issue: allows operation if no tenant label exists ```</p> <p>**Root Cause Analysis:** 1. **Missing Default Protection**: System namespaces (kube-system, default, capsule-system) do not have the `capsule.clastix.io/tenant` label by default 2. **Bypass Logic**: The webhook only enforces tenant ownership validation when the target namespace already belongs to a tenant 3. **Unrestricted Label Injection**: Authenticated users can inject arbitrary labels into unprotected namespaces</p> <p>**Attack Vector Path:** ``` Label Injecti…</p> <p><strong>Affected:</strong> Go: github.com/projectcapsule/capsule</p> <p>### Summary A namespace label injection vulnerability in Capsule v0.10.3 allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially accessing cross-tenant resources through TenantResource selectors. This vulnerability enables privilege escalation and violates the fundamental security boundaries that Capsule is designed to enforce.</p> <p>### Details The vulnerability exists in the namespace validation webhook logic located in `pkg/webhook/namespace/validation/patch.go:60-77`. The critical flaw is in the conditional check that only validates tenant ownership when a namespace already has a tenant label:</p> <p>```go if label, ok := ns.Labels[ln]; ok { // Only checks permissions when namespace has tenant label if !utils.IsTenantOwner(tnt.Spec.Owners, req.UserInfo) { response := admission.Denied(e) return &amp;response } }</p> <p>return nil // Critical issue: allows operation if no tenant label exists ```</p> <p>**Root Cause Analysis:** 1. **Missing Default Protection**: System namespaces (kube-system, default, capsule-system) do not have the `capsule.clastix.io/tenant` label by default 2. **Bypass Logic**: The webhook only enforces tenant ownership validation when the target namespace already belongs to a tenant 3. **Unrestricted Label Injection**: Authenticated users can inject arbitrary labels into unprotected namespaces</p> <p>**Attack Vector Path:** ``` Label Injecti…</p> https://cve.radiocsirt.org/vuln/ghsa-fcpm-6mxq-m5vv