Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

Summary Capsule lets a cluster administrator forbid specific metadata keys that tenant owners must not place on their own resources: Tenant.spec.namespaceOptions.forbiddenLabels / forbiddenAnnotations namespaces, Tenant.spec.serviceOptions.forbiddenLabels / forbiddenAnnotations Services, and the...

GHSA-GJW4-3V3V-RQXG Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

Summary Capsule lets a cluster administrator forbid specific metadata keys that tenant owners must not place on their own resources: Tenant.spec.namespaceOptions.forbiddenLabels / forbiddenAnnotations namespaces, Tenant.spec.serviceOptions.forbiddenLabels / forbiddenAnnotations Services, and the...

CVE-2026-61672

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7 , the ForbiddenListSpec.ExactMatch function in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively but then calls sort.SearchStrings, which assumes byte-order sorting. When an administrator's...