projectcapsule capsule

• CVE-2026-61795 Medium 6.8 Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation 0.6%
• CVE-2026-61672 High 7.1 Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement 0.3%
• CVE-2026-61794 Medium 6.8 Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic 0.6%
• CVE-2026-55636 Medium 5.7 Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected 0.4%
• CVE-2026-65835 Medium 6.6 Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) 0.2%
• CVE-2026-65834 Medium 6.8 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests 0.3%
• CVE-2026-30963 Low 3.9 Capsule Namespace Hijacking via subresource 0.2%
• CVE-2026-22872 Medium 6.9 Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability 0.7%
• CVE-2025-55205 Critical 9.1 Capsule tenant owners with "patch namespace" permission can hijack system namespaces label 0.5%
• CVE-2024-39690 High 8.5 Capsule tenant owner with "patch namespace" permission can hijack system namespaces 0.5%