---
id: CVE-2026-55636
title: Capsule is a multi-tenancy and policy-based framework for Kubernetes
summary: >-
  Capsule is a multi-tenancy and policy-based framework for Kubernetes. From
  0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures
  the validating webhook with namespace/finalize instead of the Kubernetes
  resource name…
severity: medium
cvss: 5.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L'
cwe:
  - CWE-863
vendor: projectcapsule
product: capsule
affected:
  - 'capsule >= 0.13.0, < 0.13.6'
patched:
  - github.com/projectcapsule/capsule 0.13.6
published: '2026-09-15'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T19:17:22.553'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55636'
references:
  - url: >-
      https://github.com/projectcapsule/capsule/commit/af2f37793e789b2301da8ed8dfb52ab60affebb6
    label: security-advisories@github.com
  - url: 'https://github.com/projectcapsule/capsule/pull/1966'
    label: security-advisories@github.com
  - url: 'https://github.com/projectcapsule/capsule/releases/tag/v0.13.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/projectcapsule/capsule/security/advisories/GHSA-gwxr-7h77-7777
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-gwxr-7h77-7777'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T17:38:16.677370Z'
ingestedAt: '2026-06-29T14:31:47.218Z'
epss: 0.00385
epssPercentile: 0.29836
---

## Overview

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC can send a PUT request to /api/v1/namespaces/{namespace}/finalize, and the singular rule never matches the plural resource, so the validating webhook is not invoked and the user can change the namespace tenant label. matchPolicy: Equivalent does not compensate because it handles API group and version equivalence rather than resource-name errors. This vulnerability is fixed in 0.13.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55636)

Affected packages:

- `github.com/projectcapsule/capsule >= 0.13.0, < 0.13.6`

Patched in:

- `github.com/projectcapsule/capsule 0.13.6`

Source: https://github.com/advisories/GHSA-gwxr-7h77-7777