https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 22:23:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-343227 EUVD-2026-343227 https://cve.radiocsirt.org/vuln/euvd-2026-343227 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65834 <p>Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster Admin to store a malformed regex that later reached regexp.MustCompile in pkg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and crashed the node admission webhook on Node create, update, or patch requests. This issue is fixed in version 0.13.8.</p> <p>Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster Admin to store a malformed regex that later reached regexp.MustCompile in pkg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and crashed the node admission webhook on Node create, update, or patch requests. This issue is fixed in version 0.13.8.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-65834 https://cve.radiocsirt.org/vuln/ghsa-68cj-mvg9-rgm2 <p><strong>Affected:</strong> Go: github.com/projectcapsule/capsule</p> <p>### Summary</p> <p>`CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex` and `ForbiddenAnnotations.Regex` are never validated by any admission webhook. A Cluster Admin can persist a malformed regex to etcd without being blocked. Once stored, every Node `CREATE`, `UPDATE`, or `PATCH` request triggers `regexp.MustCompile()` in `pkg/api/forbidden_list.go:36`, which **panics** and crashes the node admission webhook — causing a cluster-wide Denial of Service for all Node operations.</p> <p>### Root cause</p> <p>`internal/webhook/tenant/validation/` contains dedicated regex validators for every Tenant regex field (hostname, storageclass, ingressclass, containerregistry, etc.). `internal/webhook/cfg/` contains **no regex validator at all** — only `owners.go`, `serviceaccount.go`, and `warnings.go`.</p> <p>The downstream consumer `internal/webhook/node/user_metadata.go` calls: ```go // line 131 matched = forbiddenLabels.RegexMatch(label) // line 150 matched = forbiddenAnnotations.RegexMatch(annotation) ```</p> <p>Which routes to `pkg/api/forbidden_list.go:36`: ```go func (in ForbiddenListSpec) RegexMatch(value string) (ok bool) { if len(in.Regex) &gt; 0 { ok = regexp.MustCompile(in.Regex).MatchString(value) // ← panics on invalid regex } return ok } ```</p> <p>Unlike `regexp.Compile`, `regexp.MustCompile` panics instead of returning an error. Since no webhook validates the `CapsuleConfiguration` regex fields before storage, a malformed value reaches `MustCompile` on every Node admission reque…</p> <p><strong>Affected:</strong> Go: github.com/projectcapsule/capsule</p> <p>### Summary</p> <p>`CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex` and `ForbiddenAnnotations.Regex` are never validated by any admission webhook. A Cluster Admin can persist a malformed regex to etcd without being blocked. Once stored, every Node `CREATE`, `UPDATE`, or `PATCH` request triggers `regexp.MustCompile()` in `pkg/api/forbidden_list.go:36`, which **panics** and crashes the node admission webhook — causing a cluster-wide Denial of Service for all Node operations.</p> <p>### Root cause</p> <p>`internal/webhook/tenant/validation/` contains dedicated regex validators for every Tenant regex field (hostname, storageclass, ingressclass, containerregistry, etc.). `internal/webhook/cfg/` contains **no regex validator at all** — only `owners.go`, `serviceaccount.go`, and `warnings.go`.</p> <p>The downstream consumer `internal/webhook/node/user_metadata.go` calls: ```go // line 131 matched = forbiddenLabels.RegexMatch(label) // line 150 matched = forbiddenAnnotations.RegexMatch(annotation) ```</p> <p>Which routes to `pkg/api/forbidden_list.go:36`: ```go func (in ForbiddenListSpec) RegexMatch(value string) (ok bool) { if len(in.Regex) &gt; 0 { ok = regexp.MustCompile(in.Regex).MatchString(value) // ← panics on invalid regex } return ok } ```</p> <p>Unlike `regexp.Compile`, `regexp.MustCompile` panics instead of returning an error. Since no webhook validates the `CapsuleConfiguration` regex fields before storage, a malformed value reaches `MustCompile` on every Node admission reque…</p> https://cve.radiocsirt.org/vuln/ghsa-68cj-mvg9-rgm2