# github.com/projectcapsule/capsule (Go) vulnerabilities

11 known vulnerabilities (1 critical, 2 high, 7 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/projectcapsule/capsule

## Advisories (11)

### [CVE-2026-61795](https://cve.now/CVE-2026-61795): Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook…

- Severity: Medium 6.8
- Published: Sep 18, 2026
- Affected: from 0.13.0, fixed in 0.13.7.

### [CVE-2026-61672](https://cve.now/CVE-2026-61672): Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

- Severity: High 7.1
- Published: Sep 18, 2026
- Affected: fixed in 0.13.7.

### [CVE-2026-61794](https://cve.now/CVE-2026-61794): Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic

- Severity: Medium 6.8
- Published: Sep 18, 2026
- Affected: from 0.13.0, fixed in 0.13.7.

### [CVE-2026-55636](https://cve.now/CVE-2026-55636): Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

- Severity: Medium 5.7
- Published: Sep 15, 2026
- Affected: from 0.13.0, fixed in 0.13.6.

### [CVE-2026-65835](https://cve.now/CVE-2026-65835): Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation…

- Severity: Medium 6.6
- Published: Jul 30, 2026
- Affected: from 0.13.0, fixed in 0.13.8.

### [CVE-2026-65834](https://cve.now/CVE-2026-65834): Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

- Severity: Medium 6.8
- Published: Jul 30, 2026
- Affected: fixed in 0.13.8.

### [CVE-2026-30963](https://cve.now/CVE-2026-30963): Capsule Namespace Hijacking via subresource

- Severity: Low 3.9
- Published: Jun 1, 2026
- Affected: fixed in 0.13.0.

### [CVE-2026-22872](https://cve.now/CVE-2026-22872): Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

- Severity: Medium 6.9
- Published: Jun 1, 2026
- Affected: fixed in 0.13.0.

### [CVE-2025-55205](https://cve.now/CVE-2025-55205): Capsule tenant owners with "patch namespace" permission can hijack system namespaces label

- Severity: Critical 9.1
- Published: Aug 18, 2025
- Affected: fixed in 0.10.4.

### [CVE-2024-39690](https://cve.now/CVE-2024-39690): Capsule tenant owner with "patch namespace" permission can hijack system namespaces

- Severity: High 8.5
- Published: Aug 20, 2024
- Affected: all versions; fixed in 0.7.1.

### [CVE-2023-46254](https://cve.now/CVE-2023-46254): Service accounts can see namespaces of other tenants in capsule-proxy

- Severity: Medium 4.3
- Published: Nov 6, 2023
- Affected: fixed in 0.4.5.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/projectcapsule/capsule
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.