Answer in brief
CVE-2026-61672 records a High severity (CVSS 7.1) vulnerability in Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement. The current sources do not mark it as known exploited. The current feed maps projectcapsule/capsule (generic), github.com/projectcapsule/capsule (go), github.com/projectcapsule/capsule (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps projectcapsule/capsule (generic), github.com/projectcapsule/capsule (go), github.com/projectcapsule/capsule (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| projectcapsule/capsulegeneric | < 0.13.7 | Not reported |
| github.com/projectcapsule/capsulego | <=0.13.6 | 0.13.7 |
| github.com/projectcapsule/capsulego | >=0 <0.13.7 | 0.13.7 |
Published upstream
Sep 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 18, 2026
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When an administrator's forbidden list mixes capitalized and lowercase keys or otherwise has different case-insensitive and byte ordering, the binary search can return false for a key that is present. An authenticated tenant owner can then pass the missed key through api.ValidateForbidden and bypass configured namespace, Service, or delegated node metadata restrictions, potentially influencing cluster policies, network exposure, or scheduling outside the tenant boundary. Uniformly lowercase lists whose two orderings coincide are not affected. This issue is fixed in version 0.13.7.
Quoted source text, attributed separately from HOL analysis.