CVE-2026-65834 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
A Cluster Admin can cause a denial of service in the node admission webhook by storing malformed regex patterns in Capsule configuration.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-65834?
CVE-2026-65834 is a medium-severity denial of service vulnerability in projectcapsule capsule, published on 30 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster Admin to store a malformed regex that later reached regexp.MustCompile in pkg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and crashed the node admission webhook on Node create, update, or patch requests. This issue is fixed in version 0.13.8.
Which versions are affected by CVE-2026-65834?
3 open source packages ship an affected version, including github.com/projectcapsule/capsule.
| Package | Affected | Fixed in |
|---|---|---|
github.com/projectcapsule/capsule Go | All versions | 0.13.8 |
github.com/projectcapsule/capsule Go | All versions | 0.13.8 |
github.com/projectcapsule/capsule Go | All versions | 0.13.8 |
How do I fix CVE-2026-65834?
Upgrade github.com/projectcapsule/capsule to 0.13.8 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-65834 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65834 exists.
Sources
Also known as GHSA-68cj-mvg9-rgm2, GO-2026-6155.