Vulnerability-Lookup

CVE-2026-61795 (GCVE-0-2026-61795)

Vulnerability from cvelistv5 – Published: 2026-09-18 16:31 – Updated: 2026-09-18 16:31

Title

Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation

Summary

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

CWE

CWE-697 - Incorrect Comparison

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/projectcapsule/capsule/securit…	x_refsource_CONFIRM
https://github.com/projectcapsule/capsule/pull/1983	x_refsource_MISC
https://github.com/projectcapsule/capsule/commit/…	x_refsource_MISC
https://github.com/projectcapsule/capsule/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
projectcapsule	capsule	Affected: >= 0.13.0, < 0.13.7	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "capsule",
          "vendor": "projectcapsule",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.13.0, \u003c 0.13.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-697",
              "description": "CWE-697: Incorrect Comparison",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T16:31:42.182Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-f94q-w3w8-cj67",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-f94q-w3w8-cj67"
        },
        {
          "name": "https://github.com/projectcapsule/capsule/pull/1983",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/projectcapsule/capsule/pull/1983"
        },
        {
          "name": "https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e"
        },
        {
          "name": "https://github.com/projectcapsule/capsule/releases/tag/v0.13.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/projectcapsule/capsule/releases/tag/v0.13.7"
        }
      ],
      "source": {
        "advisory": "GHSA-f94q-w3w8-cj67",
        "discovery": "UNKNOWN"
      },
      "title": "Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61795",
    "datePublished": "2026-09-18T16:31:42.182Z",
    "dateReserved": "2026-07-10T20:06:05.617Z",
    "dateUpdated": "2026-09-18T16:31:42.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "capsule",
                "vendor": "projectcapsule",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 0.13.0, \u003c 0.13.7"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7."
          }
        ],
        "id": "CVE-2026-61795",
        "lastModified": "2026-09-18T17:16:58.867",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-18T17:16:58.867",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/projectcapsule/capsule/pull/1983"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/projectcapsule/capsule/releases/tag/v0.13.7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-f94q-w3w8-cj67"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-697"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

GHSA-F94Q-W3W8-CJ67

Vulnerability from github – Published: 2026-09-18 17:14 – Updated: 2026-09-18 17:14

Summary

Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation

Details

Summary

A parameter order bug in internal/webhook/tenant/validation/hostname_regex.go causes the hostnameRegexHandler.OnUpdate webhook to validate the old Tenant object's AllowedHostnames.Regex instead of the new one being submitted. This allows an invalid (malformed) regex to bypass admission validation and be persisted to etcd, causing a Denial of Service for all Ingress operations within the affected tenant.

Details

The TypedHandler[T] interface defines OnUpdate as:

// handlers.go
OnUpdate(c client.Client, reader client.Reader, obj T, old T, decoder admission.Decoder, recorder events.EventRecorder) Func
//                                               ^^^ NEW  ^^^ OLD

The dispatcher in handler.go:93 calls:

hndl.OnUpdate(c, reader, tnt, old, decoder, recorder)
//                        ^^^ NEW  ^^^ OLD

However, hostnameRegexHandler.OnUpdate in hostname_regex.go declares its parameters in reversed order:

// hostname_regex.go (BUGGY)
func (h *hostnameRegexHandler) OnUpdate(
    _ client.Client,
    _ client.Reader,
    old *capsulev1beta2.Tenant,   // ← receives NEW tenant (mislabeled as old)
    tnt *capsulev1beta2.Tenant,   // ← receives OLD tenant (mislabeled as tnt)
    ...
) handlers.Func {
    return func(...) *admission.Response {
        if err := h.validate(tnt, req); err != nil { // ← validates OLD, not NEW
            return err
        }
        return nil
    }
}

All 11 other handlers in the same package declare (tnt, old) correctly. hostname_regex.go is the only one with the swap.

As a result, when a Cluster Admin updates Tenant.Spec.IngressOptions.AllowedHostnames.Regex to a malformed value, the webhook compiles the previous valid regex and returns Allow. The malformed regex is then written to etcd.

Subsequently, every Ingress CREATE or UPDATE in that tenant triggers validate_hostnames.go:160:

matched, _ = regexp.MatchString(allowedRegex, currentHostname)

regexp.MatchString with an invalid pattern returns (false, error). The error is silently ignored, matched is false, and every hostname is rejected — blocking all Ingress operations in the tenant until the Tenant object is manually corrected by an admin.

PoC

//go:build ignore
// Standalone reproducer for hostname_regex.go argument swap bug in Capsule
// No external deps - shows the bug logic using only stdlib

package main

import (
    "fmt"
    "regexp"
)

// Simulating the Tenant spec structure
type AllowedHostnames struct {
    Regex string
}

type IngressOptions struct {
    AllowedHostnames *AllowedHostnames
}

type TenantSpec struct {
    IngressOptions IngressOptions
}

type Tenant struct {
    Name string
    Spec TenantSpec
}

// =========================================================
// BUGGY implementation (hostname_regex.go as-is)
// OnUpdate(_, _, old *Tenant, tnt *Tenant) → validates OLD
// =========================================================
func hostnameValidate(tnt *Tenant) error {
    if tnt.Spec.IngressOptions.AllowedHostnames == nil {
        return nil
    }
    if len(tnt.Spec.IngressOptions.AllowedHostnames.Regex) == 0 {
        return nil
    }
    _, err := regexp.Compile(tnt.Spec.IngressOptions.AllowedHostnames.Regex)
    if err != nil {
        return fmt.Errorf("Deny: unable to compile allowedHostnames allowedRegex")
    }
    return nil
}

// Dispatcher calls: OnUpdate(c, reader, newTenant, oldTenant, ...)
// Interface says:   OnUpdate(c, reader, obj[NEW], old[OLD], ...)
//
// BUGGY handler receives: (old, tnt) meaning:
//   3rd param (labeled "old") = actually NEW
//   4th param (labeled "tnt") = actually OLD
// Then calls h.validate(tnt) = validates the OLD tenant
func buggyOnUpdate(newTenant, oldTenant *Tenant) error {
    // BUG: parameters are SWAPPED vs the interface contract
    old := newTenant // dispatcher's "new" arrives as "old" in this function
    tnt := oldTenant // dispatcher's "old" arrives as "tnt" in this function
    _ = old          // unused in the real code too
    return hostnameValidate(tnt) // validates OLD, not NEW
}

// CORRECT implementation (what it should be)
func correctOnUpdate(newTenant, oldTenant *Tenant) error {
    _ = oldTenant
    return hostnameValidate(newTenant) // validates NEW
}

// Simulate ingress hostname validation AFTER bad regex is stored
func validateIngressHostname(tenant *Tenant, hostname string) bool {
    if tenant.Spec.IngressOptions.AllowedHostnames == nil {
        return true
    }
    allowedRegex := tenant.Spec.IngressOptions.AllowedHostnames.Regex
    if len(allowedRegex) == 0 {
        return true
    }
    // This is validate_hostnames.go:160 - error is IGNORED
    matched, _ := regexp.MatchString(allowedRegex, hostname)
    return matched
}

func main() {
    fmt.Println("=== Capsule Bug Reproducer: hostname_regex.go argument swap ===")
    fmt.Println()

    oldTenant := &Tenant{
        Name: "demo-tenant",
        Spec: TenantSpec{
            IngressOptions: IngressOptions{
                AllowedHostnames: &AllowedHostnames{
                    Regex: `^[\w.-]+\.example\.com$`, // valid regex
                },
            },
        },
    }

    // Attacker (cluster admin) sets an INVALID regex in the new spec
    newTenant := &Tenant{
        Name: "demo-tenant",
        Spec: TenantSpec{
            IngressOptions: IngressOptions{
                AllowedHostnames: &AllowedHostnames{
                    Regex: `[invalid-regex(`, // INVALID regex
                },
            },
        },
    }

    fmt.Printf("Old tenant regex: %q (valid)\n", oldTenant.Spec.IngressOptions.AllowedHostnames.Regex)
    fmt.Printf("New tenant regex: %q (INVALID)\n", newTenant.Spec.IngressOptions.AllowedHostnames.Regex)
    fmt.Println()

    // Step 1: Webhook runs OnUpdate
    fmt.Println("--- Step 1: Webhook OnUpdate ---")

    err := buggyOnUpdate(newTenant, oldTenant)
    if err != nil {
        fmt.Printf("[BUGGY]   Webhook DENIES update: %v\n", err)
    } else {
        fmt.Println("[BUGGY]   Webhook ALLOWS update (validates OLD regex) ← WRONG")
    }

    err = correctOnUpdate(newTenant, oldTenant)
    if err != nil {
        fmt.Printf("[CORRECT] Webhook DENIES update: %v ← EXPECTED\n", err)
    } else {
        fmt.Println("[CORRECT] Webhook ALLOWS update")
    }

    // Step 2: Invalid regex now stored in etcd - simulate ingress validation
    fmt.Println()
    fmt.Println("--- Step 2: Ingress creation after bad regex stored ---")
    storedTenant := newTenant // bad regex is now in etcd

    hostnames := []string{
        "app.example.com",
        "api.example.com",
        "evil.attacker.com",
    }

    for _, h := range hostnames {
        allowed := validateIngressHostname(storedTenant, h)
        fmt.Printf("  Ingress hostname %q → allowed=%v", h, allowed)
        if !allowed {
            fmt.Print("  ← BLOCKED (DoS: invalid regex causes all hostnames to fail)")
        }
        fmt.Println()
    }

    fmt.Println()
    fmt.Println("=== Result ===")
    fmt.Println("Invalid regex bypasses webhook validation and gets stored.")
    fmt.Println("All subsequent Ingress create/update in this tenant are BLOCKED.")
    fmt.Println("CWE-697: Incorrect Comparison — wrong Tenant object is validated.")
}

// Simulates the buggy webhook behaviour
oldTenant := &Tenant{AllowedRegex: `^[\w-]+\.example\.com$`} // valid
newTenant := &Tenant{AllowedRegex: `[invalid-regex(`}         // malformed

// Buggy OnUpdate: validates oldTenant (valid) → ALLOW
// Correct OnUpdate: validates newTenant (invalid) → DENY

// After malformed regex is stored, all ingress hostnames are rejected:
matched, _ := regexp.MatchString(`[invalid-regex(`, "app.example.com")
// matched = false, error ignored → Ingress blocked

Fix

Swap the parameter names in hostname_regex.go to match the interface contract:

// BEFORE (buggy)
func (h *hostnameRegexHandler) OnUpdate(
    _ client.Client,
    _ client.Reader,
    old *capsulev1beta2.Tenant,
    tnt *capsulev1beta2.Tenant,
    ...

// AFTER (fixed)
func (h *hostnameRegexHandler) OnUpdate(
    _ client.Client,
    _ client.Reader,
    tnt *capsulev1beta2.Tenant,
    old *capsulev1beta2.Tenant,
    ...

Impact

A Cluster Admin (or a compromised admin account) can — intentionally or via a typo — set a malformed AllowedHostnames.Regex on any Tenant. The webhook silently accepts the update. All users in the affected tenant are subsequently unable to create or update any Ingress resource until an admin manually corrects the Tenant spec. This constitutes a targeted Denial of Service against the tenant's ingress layer.

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/projectcapsule/capsule"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.13.0"
            },
            {
              "fixed": "0.13.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61795"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-697"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-18T17:14:43Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA parameter order bug in `internal/webhook/tenant/validation/hostname_regex.go` causes the `hostnameRegexHandler.OnUpdate` webhook to validate the **old** Tenant object\u0027s `AllowedHostnames.Regex` instead of the **new** one being submitted. This allows an invalid (malformed) regex to bypass admission validation and be persisted to etcd, causing a Denial of Service for all Ingress operations within the affected tenant.\n\n### Details\n\nThe `TypedHandler[T]` interface defines `OnUpdate` as:\n\n```go\n// handlers.go\nOnUpdate(c client.Client, reader client.Reader, obj T, old T, decoder admission.Decoder, recorder events.EventRecorder) Func\n//                                               ^^^ NEW  ^^^ OLD\n```\n\nThe dispatcher in `handler.go:93` calls:\n```go\nhndl.OnUpdate(c, reader, tnt, old, decoder, recorder)\n//                        ^^^ NEW  ^^^ OLD\n```\n\nHowever, `hostnameRegexHandler.OnUpdate` in `hostname_regex.go` declares its parameters in **reversed order**:\n\n```go\n// hostname_regex.go (BUGGY)\nfunc (h *hostnameRegexHandler) OnUpdate(\n    _ client.Client,\n    _ client.Reader,\n    old *capsulev1beta2.Tenant,   // \u2190 receives NEW tenant (mislabeled as old)\n    tnt *capsulev1beta2.Tenant,   // \u2190 receives OLD tenant (mislabeled as tnt)\n    ...\n) handlers.Func {\n    return func(...) *admission.Response {\n        if err := h.validate(tnt, req); err != nil { // \u2190 validates OLD, not NEW\n            return err\n        }\n        return nil\n    }\n}\n```\n\nAll 11 other handlers in the same package declare `(tnt, old)` correctly. `hostname_regex.go` is the only one with the swap.\n\nAs a result, when a Cluster Admin updates `Tenant.Spec.IngressOptions.AllowedHostnames.Regex` to a malformed value, the webhook compiles the **previous valid regex** and returns `Allow`. The malformed regex is then written to etcd.\n\nSubsequently, every Ingress `CREATE` or `UPDATE` in that tenant triggers `validate_hostnames.go:160`:\n\n```go\nmatched, _ = regexp.MatchString(allowedRegex, currentHostname)\n```\n\n`regexp.MatchString` with an invalid pattern returns `(false, error)`. The error is silently ignored, `matched` is `false`, and **every hostname is rejected** \u2014 blocking all Ingress operations in the tenant until the Tenant object is manually corrected by an admin.\n\n### PoC\n\n```\n//go:build ignore\n// Standalone reproducer for hostname_regex.go argument swap bug in Capsule\n// No external deps - shows the bug logic using only stdlib\n\npackage main\n\nimport (\n\t\"fmt\"\n\t\"regexp\"\n)\n\n// Simulating the Tenant spec structure\ntype AllowedHostnames struct {\n\tRegex string\n}\n\ntype IngressOptions struct {\n\tAllowedHostnames *AllowedHostnames\n}\n\ntype TenantSpec struct {\n\tIngressOptions IngressOptions\n}\n\ntype Tenant struct {\n\tName string\n\tSpec TenantSpec\n}\n\n// =========================================================\n// BUGGY implementation (hostname_regex.go as-is)\n// OnUpdate(_, _, old *Tenant, tnt *Tenant) \u2192 validates OLD\n// =========================================================\nfunc hostnameValidate(tnt *Tenant) error {\n\tif tnt.Spec.IngressOptions.AllowedHostnames == nil {\n\t\treturn nil\n\t}\n\tif len(tnt.Spec.IngressOptions.AllowedHostnames.Regex) == 0 {\n\t\treturn nil\n\t}\n\t_, err := regexp.Compile(tnt.Spec.IngressOptions.AllowedHostnames.Regex)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Deny: unable to compile allowedHostnames allowedRegex\")\n\t}\n\treturn nil\n}\n\n// Dispatcher calls: OnUpdate(c, reader, newTenant, oldTenant, ...)\n// Interface says:   OnUpdate(c, reader, obj[NEW], old[OLD], ...)\n//\n// BUGGY handler receives: (old, tnt) meaning:\n//   3rd param (labeled \"old\") = actually NEW\n//   4th param (labeled \"tnt\") = actually OLD\n// Then calls h.validate(tnt) = validates the OLD tenant\nfunc buggyOnUpdate(newTenant, oldTenant *Tenant) error {\n\t// BUG: parameters are SWAPPED vs the interface contract\n\told := newTenant // dispatcher\u0027s \"new\" arrives as \"old\" in this function\n\ttnt := oldTenant // dispatcher\u0027s \"old\" arrives as \"tnt\" in this function\n\t_ = old          // unused in the real code too\n\treturn hostnameValidate(tnt) // validates OLD, not NEW\n}\n\n// CORRECT implementation (what it should be)\nfunc correctOnUpdate(newTenant, oldTenant *Tenant) error {\n\t_ = oldTenant\n\treturn hostnameValidate(newTenant) // validates NEW\n}\n\n// Simulate ingress hostname validation AFTER bad regex is stored\nfunc validateIngressHostname(tenant *Tenant, hostname string) bool {\n\tif tenant.Spec.IngressOptions.AllowedHostnames == nil {\n\t\treturn true\n\t}\n\tallowedRegex := tenant.Spec.IngressOptions.AllowedHostnames.Regex\n\tif len(allowedRegex) == 0 {\n\t\treturn true\n\t}\n\t// This is validate_hostnames.go:160 - error is IGNORED\n\tmatched, _ := regexp.MatchString(allowedRegex, hostname)\n\treturn matched\n}\n\nfunc main() {\n\tfmt.Println(\"=== Capsule Bug Reproducer: hostname_regex.go argument swap ===\")\n\tfmt.Println()\n\n\toldTenant := \u0026Tenant{\n\t\tName: \"demo-tenant\",\n\t\tSpec: TenantSpec{\n\t\t\tIngressOptions: IngressOptions{\n\t\t\t\tAllowedHostnames: \u0026AllowedHostnames{\n\t\t\t\t\tRegex: `^[\\w.-]+\\.example\\.com$`, // valid regex\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t}\n\n\t// Attacker (cluster admin) sets an INVALID regex in the new spec\n\tnewTenant := \u0026Tenant{\n\t\tName: \"demo-tenant\",\n\t\tSpec: TenantSpec{\n\t\t\tIngressOptions: IngressOptions{\n\t\t\t\tAllowedHostnames: \u0026AllowedHostnames{\n\t\t\t\t\tRegex: `[invalid-regex(`, // INVALID regex\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t}\n\n\tfmt.Printf(\"Old tenant regex: %q (valid)\\n\", oldTenant.Spec.IngressOptions.AllowedHostnames.Regex)\n\tfmt.Printf(\"New tenant regex: %q (INVALID)\\n\", newTenant.Spec.IngressOptions.AllowedHostnames.Regex)\n\tfmt.Println()\n\n\t// Step 1: Webhook runs OnUpdate\n\tfmt.Println(\"--- Step 1: Webhook OnUpdate ---\")\n\n\terr := buggyOnUpdate(newTenant, oldTenant)\n\tif err != nil {\n\t\tfmt.Printf(\"[BUGGY]   Webhook DENIES update: %v\\n\", err)\n\t} else {\n\t\tfmt.Println(\"[BUGGY]   Webhook ALLOWS update (validates OLD regex) \u2190 WRONG\")\n\t}\n\n\terr = correctOnUpdate(newTenant, oldTenant)\n\tif err != nil {\n\t\tfmt.Printf(\"[CORRECT] Webhook DENIES update: %v \u2190 EXPECTED\\n\", err)\n\t} else {\n\t\tfmt.Println(\"[CORRECT] Webhook ALLOWS update\")\n\t}\n\n\t// Step 2: Invalid regex now stored in etcd - simulate ingress validation\n\tfmt.Println()\n\tfmt.Println(\"--- Step 2: Ingress creation after bad regex stored ---\")\n\tstoredTenant := newTenant // bad regex is now in etcd\n\n\thostnames := []string{\n\t\t\"app.example.com\",\n\t\t\"api.example.com\",\n\t\t\"evil.attacker.com\",\n\t}\n\n\tfor _, h := range hostnames {\n\t\tallowed := validateIngressHostname(storedTenant, h)\n\t\tfmt.Printf(\"  Ingress hostname %q \u2192 allowed=%v\", h, allowed)\n\t\tif !allowed {\n\t\t\tfmt.Print(\"  \u2190 BLOCKED (DoS: invalid regex causes all hostnames to fail)\")\n\t\t}\n\t\tfmt.Println()\n\t}\n\n\tfmt.Println()\n\tfmt.Println(\"=== Result ===\")\n\tfmt.Println(\"Invalid regex bypasses webhook validation and gets stored.\")\n\tfmt.Println(\"All subsequent Ingress create/update in this tenant are BLOCKED.\")\n\tfmt.Println(\"CWE-697: Incorrect Comparison \u2014 wrong Tenant object is validated.\")\n}\n```\n\n\n\n\n```go\n// Simulates the buggy webhook behaviour\noldTenant := \u0026Tenant{AllowedRegex: `^[\\w-]+\\.example\\.com$`} // valid\nnewTenant := \u0026Tenant{AllowedRegex: `[invalid-regex(`}         // malformed\n\n// Buggy OnUpdate: validates oldTenant (valid) \u2192 ALLOW\n// Correct OnUpdate: validates newTenant (invalid) \u2192 DENY\n\n// After malformed regex is stored, all ingress hostnames are rejected:\nmatched, _ := regexp.MatchString(`[invalid-regex(`, \"app.example.com\")\n// matched = false, error ignored \u2192 Ingress blocked\n```\n\n### Fix\n\nSwap the parameter names in `hostname_regex.go` to match the interface contract:\n\n```go\n// BEFORE (buggy)\nfunc (h *hostnameRegexHandler) OnUpdate(\n    _ client.Client,\n    _ client.Reader,\n    old *capsulev1beta2.Tenant,\n    tnt *capsulev1beta2.Tenant,\n    ...\n\n// AFTER (fixed)\nfunc (h *hostnameRegexHandler) OnUpdate(\n    _ client.Client,\n    _ client.Reader,\n    tnt *capsulev1beta2.Tenant,\n    old *capsulev1beta2.Tenant,\n    ...\n```\n\n### Impact\n\nA Cluster Admin (or a compromised admin account) can \u2014 intentionally or via a typo \u2014 set a malformed `AllowedHostnames.Regex` on any Tenant. The webhook silently accepts the update. All users in the affected tenant are subsequently unable to create or update any Ingress resource until an admin manually corrects the Tenant spec. This constitutes a targeted Denial of Service against the tenant\u0027s ingress layer.",
  "id": "GHSA-f94q-w3w8-cj67",
  "modified": "2026-09-18T17:14:43Z",
  "published": "2026-09-18T17:14:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-f94q-w3w8-cj67"
    },
    {
      "type": "WEB",
      "url": "https://github.com/projectcapsule/capsule/pull/1983"
    },
    {
      "type": "WEB",
      "url": "https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/projectcapsule/capsule"
    },
    {
      "type": "WEB",
      "url": "https://github.com/projectcapsule/capsule/releases/tag/v0.13.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-61795 (GCVE-0-2026-61795)

GHSA-F94Q-W3W8-CJ67

Summary

Details

PoC

Fix

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour