CVE-2026-30963 Capsule Namespace Hijacking via subresource
Tenant administrators can hijack namespaces by exploiting missing webhook validation on namespace subresources, leading to unauthorized privilege escalation and data modification.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-30963?
CVE-2026-30963 is a low-severity missing authorization vulnerability in projectcapsule capsule, published on 1 Jun 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and namespace/status subresource APIs can also modify various fields of a namespace, including the metadata field. Prior to version 0.13.0, the webhook does not define interception rules for these subresources. As a result, if a tenant administrator has permission to modify namespace/status or namespace/finalize, they can successfully perform namespace hijacking. Version 0.13.0 fixes the issue. Another mitigation is to add two subresources (namespaces and snamespaces/status with namespace/finalize within it) to the resources list in the ValidatingWebhookConfiguration rules.
Weakness: CWE-20
Which versions are affected by CVE-2026-30963?
3 open source packages ship an affected version, including github.com/projectcapsule/capsule. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/projectcapsule/capsule Go | All versions | 0.13.0 |
github.com/projectcapsule/capsule Go | All versions | 0.13.0 |
github.com/projectcapsule/capsule Go | All versions | 0.13.0 |
Products include Projectcapsule Capsule.
How do I fix CVE-2026-30963?
Upgrade github.com/projectcapsule/capsule to 0.13.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-30963 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30963 exists.
Other vulnerabilities in projectcapsule capsule
Sources
Also known as GHSA-2ww6-hf35-mfjm, GO-2026-5043.