CVE-2026-55636 Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected
Attackers with specific RBAC permissions can bypass validation to modify namespace tenant labels due to a typo in webhook configuration.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55636?
CVE-2026-55636 is a medium-severity missing authorization vulnerability in projectcapsule capsule, published on 15 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC can send a PUT request to /api/v1/namespaces/{namespace}/finalize, and the singular rule never matches the plural resource, so the validating webhook is not invoked and the user can change the namespace tenant label. matchPolicy: Equivalent does not compensate because it handles API group and version equivalence rather than resource-name errors. This vulnerability is fixed in 0.13.6.
Weakness: CWE-863
Which versions are affected by CVE-2026-55636?
3 open source packages ship an affected version, including github.com/projectcapsule/capsule.
| Package | Affected | Fixed in |
|---|---|---|
github.com/projectcapsule/capsule Go | From 0.13.0 | 0.13.6 |
github.com/projectcapsule/capsule Go | From 0.13.0 | 0.13.6 |
github.com/projectcapsule/capsule Go | From 0.13.0 | 0.13.6 |
How do I fix CVE-2026-55636?
Upgrade github.com/projectcapsule/capsule to 0.13.6 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-55636 being exploited?
There is no known exploitation of CVE-2026-55636 in the wild and no public exploit code.
Sources
Also known as GHSA-gwxr-7h77-7777, GO-2026-5406.