https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:21:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-373542 EUVD-2026-373542 https://cve.radiocsirt.org/vuln/euvd-2026-373542 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61794 <p>Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.</p> <p>Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-61794 https://cve.radiocsirt.org/vuln/ghsa-gxjc-74v5-3vx3 <p><strong>Affected:</strong> Go: github.com/projectcapsule/capsule</p> <p>### Summary A validation bug in `internal/webhook/tenant/validation/forbidden_annotations_regex.go` allows an invalid `ForbiddenAnnotations.Regex` value to bypass Tenant admission on update. The webhook compiles `ForbiddenLabels.Regex` for both labels and annotations, so a malformed annotations regex can be persisted. Once stored, namespace admission later evaluates the bad regex through `pkg/api/forbidden_list.go`, where `regexp.MustCompile` can panic and cause admission failure.</p> <p>### Details In `internal/webhook/tenant/validation/forbidden_annotations_regex.go`, `OnUpdate` validates the new Tenant object, but the loop compiles `tnt.Spec.NamespaceOptions.ForbiddenLabels.Regex` for both `labels` and `annotations`. That means an invalid `ForbiddenAnnotations.Regex` is never validated if `ForbiddenLabels.Regex` is valid.</p> <p>Relevant paths: - `internal/webhook/tenant/validation/forbidden_annotations_regex.go` - `internal/webhook/namespace/validation/user_metadata.go` - `pkg/api/forbidden_list.go`</p> <p>Namespace admission later calls `api.ValidateForbidden(...)`, and `ForbiddenListSpec.RegexMatch()` uses `regexp.MustCompile(in.Regex)`. If the malformed regex is present in the Tenant spec, any namespace request that reaches this check can panic or fail hard, causing denial of service for namespace operations in the affected tenant.</p> <p>### PoC 1. Update a Tenant so that: - `spec.namespaceOptions.forbiddenLabels.regex` is valid - `spec.namespaceOptions.forbiddenAnnotations.regex` is…</p> <p><strong>Affected:</strong> Go: github.com/projectcapsule/capsule</p> <p>### Summary A validation bug in `internal/webhook/tenant/validation/forbidden_annotations_regex.go` allows an invalid `ForbiddenAnnotations.Regex` value to bypass Tenant admission on update. The webhook compiles `ForbiddenLabels.Regex` for both labels and annotations, so a malformed annotations regex can be persisted. Once stored, namespace admission later evaluates the bad regex through `pkg/api/forbidden_list.go`, where `regexp.MustCompile` can panic and cause admission failure.</p> <p>### Details In `internal/webhook/tenant/validation/forbidden_annotations_regex.go`, `OnUpdate` validates the new Tenant object, but the loop compiles `tnt.Spec.NamespaceOptions.ForbiddenLabels.Regex` for both `labels` and `annotations`. That means an invalid `ForbiddenAnnotations.Regex` is never validated if `ForbiddenLabels.Regex` is valid.</p> <p>Relevant paths: - `internal/webhook/tenant/validation/forbidden_annotations_regex.go` - `internal/webhook/namespace/validation/user_metadata.go` - `pkg/api/forbidden_list.go`</p> <p>Namespace admission later calls `api.ValidateForbidden(...)`, and `ForbiddenListSpec.RegexMatch()` uses `regexp.MustCompile(in.Regex)`. If the malformed regex is present in the Tenant spec, any namespace request that reaches this check can panic or fail hard, causing denial of service for namespace operations in the affected tenant.</p> <p>### PoC 1. Update a Tenant so that: - `spec.namespaceOptions.forbiddenLabels.regex` is valid - `spec.namespaceOptions.forbiddenAnnotations.regex` is…</p> https://cve.radiocsirt.org/vuln/ghsa-gxjc-74v5-3vx3