Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic
### Summary A validation bug in `internal/webhook/tenant/validation/forbidden_annotations_regex.go` allows an invalid `ForbiddenAnnotations.Regex` value to bypass Tenant admission on update. The webhook compiles `ForbiddenLabels.Regex` for both labels and annotations, so a malformed annotations regex can be persisted. Once stored, namespace admission later evaluates the bad regex through `pkg/api/forbidden_list.go`, where `regexp.MustCompile` can panic and cause admission failure. ### Details In `internal/webhook/tenant/validation/forbidden_annotations_regex.go`, `OnUpdate` validates the new Tenant object, but the loop compiles `tnt.Spec.NamespaceOptions.ForbiddenLabels.Regex` for both `labels` and `annotations`. That means an invalid `ForbiddenAnnotations.Regex` is never validated if `ForbiddenLabels.Regex` is valid. Relevant paths: - `internal/webhook/tenant/validation/forbidden_annotations_regex.go` - `internal/webhook/namespace/validation/user_metadata.go` - `pkg/api/forbidden_list.go` Namespace admission later calls `api.ValidateForbidden(...)`, and `ForbiddenListSpec.RegexMatch()` uses `regexp.MustCompile(in.Regex)`. If the malformed regex is present in the Tenant spec, any namespace request that reaches this check can panic or fail hard, causing denial of service for namespace operations in the affected tenant. ### PoC 1. Update a Tenant so that: - `spec.namespaceOptions.forbiddenLabels.regex` is valid - `spec.namespaceOptions.forbiddenAnnotations.regex` is malformed,
GO-2026-6521
Revision 1
Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule
Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GO-2026-6521
github.com/projectcapsule/capsule
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.13.7
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0.13.0"
},
{
"fixed": "0.13.7"
}
]
}
],
"package": {
"name": "github.com/projectcapsule/capsule",
"purl": "pkg:golang/github.com/projectcapsule/capsule",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://vuln.go.dev/ID/GO-2026-6521.json"
},
"ecosystem_specific": {}
}
]- Related CVEs
- CVE-2026-61794
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #23368 · Revision 1
- Added to Heist Feed
- Publisher date
GHSA-gxjc-74v5-3vx3
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-gxjc-74v5-3vx3
github.com/projectcapsule/capsule
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.13.7
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0.13.0"
},
{
"fixed": "0.13.7"
}
]
}
],
"package": {
"name": "github.com/projectcapsule/capsule",
"purl": "pkg:golang/github.com/projectcapsule/capsule",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gxjc-74v5-3vx3/GHSA-gxjc-74v5-3vx3.json"
}
}
]- Related CVEs
- CVE-2026-61794
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #23424 · Revision 1
- Added to Heist Feed
- Publisher date