CVE-2026-61672 Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbiddenlist.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When an administrator's forbidden list...

CVE-2026-61672

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbiddenlist.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When an administrator's forbidden list...

CVE-2026-61672: Incorrect Comparison

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbiddenlist.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When an administrator's forbidden list...

PT-2026-95488

Name of the Vulnerable Software and Affected Versions Capsule versions prior to 0.13.7 Description An issue exists in the ForbiddenListSpec.ExactMatch function within pkg/api/forbidden list.go where denied metadata keys are sorted case-insensitively but then searched using a byte-order binary...