GO-2026-6519 Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation in github.com/projectcapsule/capsule

Capsule: hostnameRegexHandler.OnUpdate validates stale old Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation in github.com/projectcapsule/capsule...

CVE-2026-61795: Incorrect Comparison

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostnameregex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitte...

PT-2026-95490

Name of the Vulnerable Software and Affected Versions Capsule versions 0.13.0 through 0.13.6 Description A parameter order bug in the hostnameRegexHandler.OnUpdate function within internal/webhook/tenant/validation/hostname regex.go causes the webhook to validate the old Tenant object instead of...