34 matches found
CVE-2025-1974
CVE-2025-1974 — IngressNightmare ingress-nginx はじめに 本書では、Kubernetes の ingress-nginx コンポーネント（validating admission controller）に影響を及ぼす脆弱性 CVE-2025-1974 に関する調査を紹介します。 CVE-2025-1974 は CVSS 3.1 9.8 の重大な脆弱性であり、ingress-nginx プロセスのコンテキストでの未認証の Remote Code Execution RCE です。攻撃を実行すると、pod ネットワークへのアクセス（または...
CVE-2021-25735
CVE-2021-25735 CVE-2021-25735 を悪用する: Kubernetes Validating Admission Webhook バイパス 脆弱性環境のセットアップ まず、gencerts.sh スクリプトを実行して TLS 証明書と鍵を生成します。 bash gencerts.sh アドミッションコントローラをデプロイするには、以下のコマンドを使用して Docker コンテナイメージをローカルでビルドし、タグを付け、イメージを Dockerhub にプッシュする必要があります。 docker login docker build -t...
externalip-webhook
externalip-webhook CVE-2020-8554 に対処するために作成されました。 注: このチャートはKubernetes 1.21では非推奨であり、1.22以降ではサポートされていません。CVE-2020-8554を軽減するには、クラスターで DenyServiceExternalIPs アドミッションコントローラー を有効にしてください。 externalip-webhook は、サービスがランダムな外部IPを使用することを防ぐ検証用Webhookです。クラスター管理者は、allowed-external-ip-cidrs...
CVE-2026-55636
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...
EUVD-2026-78670
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...
CVE-2026-55636 Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...
CVE-2026-55636
Capsule (a multi-tenancy and policy-based framework for Kubernetes) versions 0.13.0 through 0.13.6 contain a singular/plural typo in charts/capsule/templates/configuration.yaml: the validating webhook rule specifies namespace/finalize instead of namespaces/finalize. Because Kubernetes webhook rul...
CVE-2026-55636: Incorrect Authorization
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC c...
GO-2024-2428 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller...
SUSE CVE-2026-30963
Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and...
GHSA-GC3J-79F2-7VVW Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance
Summary A low-privilege developer who could create a KubernetesWatchTrigger KWT in their own namespace was able to establish a persistent surveillance channel over any other namespace. Details Two independent flaws compounded: 1. pkg/kubewatcher/kubewatcher.go::createKubernetesWatch used...
Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected
Summary Capsule v0.13.2 webhook rules contain namespace/finalize singular instead of namespaces/finalize plural. K8s requires plural. The finalize defense from CVE-2026-30963 fix is absent. Details PUT to /api/v1/namespaces//finalize has resource=namespaces plural. The singular rule never matches...
CVE-2026-30963
Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and...
CVE-2026-30963
Capsule (a Kubernetes multi-tenancy framework) relied on a webhook to validate namespace updates, but prior to v0.13.0 it did not intercept namespace/status or namespace/finalize subresource changes. This omission enables a tenant with permission to modify those subresources to hijack other names...
CVE-2026-30963 Capsule Namespace Hijacking via subresource
Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and...
CVE-2026-30963 Capsule Namespace Hijacking via subresource
Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and...
EUVD-2026-33739
Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and...
GHSA-2WW6-HF35-MFJM Capsule Namespace Hijacking via subresource
Summary To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and namespace/status subresource APIs can also modify various fields of a...
Capsule Namespace Hijacking via subresource
Summary To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and namespace/status subresource APIs can also modify various fields of a...
PT-2026-44722
Name of the Vulnerable Software and Affected Versions Capsule versions prior to 0.13.0 Description Capsule uses a webhook to validate update requests targeting namespaces to prevent namespace hijacking. However, the webhook fails to define interception rules for the 'namespace/finalize' and...