{"id":"CVE-2026-55636","title":"Capsule is a multi-tenancy and policy-based framework for Kubernetes","summary":"Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name…","severity":"medium","cvss":5.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L","cwe":["CWE-863"],"vendor":"projectcapsule","product":"capsule","affected":["capsule >= 0.13.0, < 0.13.6"],"patched":["github.com/projectcapsule/capsule 0.13.6"],"published":"2026-09-15","updated":"2026-09-15","sourceUpdated":"2026-09-15T19:17:22.553","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55636","references":[{"url":"https://github.com/projectcapsule/capsule/commit/af2f37793e789b2301da8ed8dfb52ab60affebb6","label":"security-advisories@github.com"},{"url":"https://github.com/projectcapsule/capsule/pull/1966","label":"security-advisories@github.com"},{"url":"https://github.com/projectcapsule/capsule/releases/tag/v0.13.6","label":"security-advisories@github.com"},{"url":"https://github.com/projectcapsule/capsule/security/advisories/GHSA-gwxr-7h77-7777","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-gwxr-7h77-7777"}],"tags":["nvd","cve.org","ghsa","go"],"ecosystem":"go","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-15T17:38:16.677370Z"},"ingestedAt":"2026-06-29T14:31:47.218Z","epss":0.00277,"epssPercentile":0.20354,"slug":"CVE-2026-55636","body":"## Overview\n\nCapsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC can send a PUT request to /api/v1/namespaces/{namespace}/finalize, and the singular rule never matches the plural resource, so the validating webhook is not invoked and the user can change the namespace tenant label. matchPolicy: Equivalent does not compensate because it handles API group and version equivalence rather than resource-name errors. This vulnerability is fixed in 0.13.6.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55636)\n\nAffected packages:\n\n- `github.com/projectcapsule/capsule >= 0.13.0, < 0.13.6`\n\nPatched in:\n\n- `github.com/projectcapsule/capsule 0.13.6`\n\nSource: https://github.com/advisories/GHSA-gwxr-7h77-7777","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":31.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}