Description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially accessing cross-tenant resources through TenantResource selectors. This vulnerability enables privilege escalation and violates the fundamental security boundaries that Capsule is designed to enforce. This vulnerability is fixed in 0.10.4.
Problem types
CWE-863: Incorrect Authorization
Product status
References
github.com/...apsule/security/advisories/GHSA-fcpm-6mxq-m5vv
github.com/...ommit/e1f47feade6e1695b2204407607d07c3b3994f6e
