CVE-2026-61795 Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation
A logic error in Capsule allows administrators to save invalid hostname regexes, causing subsequent Ingress operations to fail for affected tenants.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61795?
CVE-2026-61795 is a medium-severity vulnerability in projectcapsule capsule, published on 18 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7.
Weakness: CWE-697
Which versions are affected by CVE-2026-61795?
3 open source packages ship an affected version, including github.com/projectcapsule/capsule.
| Package | Affected | Fixed in |
|---|---|---|
github.com/projectcapsule/capsule Go | From 0.13.0 | 0.13.7 |
github.com/projectcapsule/capsule Go | From 0.13.0 | 0.13.7 |
github.com/projectcapsule/capsule Go | From 0.13.0 | 0.13.7 |
How do I fix CVE-2026-61795?
Upgrade github.com/projectcapsule/capsule to 0.13.7 or later.
Is CVE-2026-61795 being exploited?
There is no known exploitation of CVE-2026-61795 in the wild and no public exploit code.
Sources
Also known as GHSA-f94q-w3w8-cj67, GO-2026-6519.