CVE-2026-65834

Deferred Deferred - Pending Action

Capsule Kubernetes Framework Regex Validation Bypass

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster Admin to store a malformed regex that later reached regexp.MustCompile in pkg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and crashed the node admission webhook on Node create, update, or patch requests. This issue is fixed in version 0.13.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-65834

EUVD

EUVD-2026-51295

Affected Vendors & Products

Vendor	Product	Version / Range
capsule	capsule	to 0.13.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

CVE-2026-65834 is a vulnerability in Capsule, a Kubernetes multi-tenancy framework. It involves improper validation of regex patterns in CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex. A malformed regex stored by a Cluster Admin could crash the node admission webhook during Node create, update, or patch requests.

Detection Guidance

This vulnerability can be detected by checking the Capsule version installed on your Kubernetes nodes. If the version is below 0.13.8, the system is vulnerable. Run: kubectl get pods -n capsule-system -l app=capsule -o jsonpath='{.items[*].spec.containers[0].image}' to check the version.

Impact Analysis

This vulnerability can cause the node admission webhook to crash, disrupting Kubernetes operations. Cluster Admins could exploit it to destabilize the system by storing malicious regex patterns, leading to denial of service for Node management tasks.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it is a technical flaw in regex validation within a Kubernetes framework. However, if exploited, it could disrupt Kubernetes node admission controls, potentially affecting system availability and integrity, which may indirectly impact compliance by compromising data processing environments.

Mitigation Strategies

Upgrade Capsule to version 0.13.8 or later to fix the regex validation issue in the configuration admission webhook.

Hi! I’m here to help you understand CVE-2026-65834. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70