CVE-2026-65834

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster Admin to store a malformed regex that later reached regexp.MustCompile in pkg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and crashed the node admission webhook on Node create, update, or patch requests. This issue is fixed in version 0.13.8.

• CWE-20
• CWE-248

• https://github.com/projectcapsule/capsule/releases/tag/v0.13.8
• https://github.com/projectcapsule/capsule/security/advisories/GHSA-68cj-mvg9-rgm2
• https://github.com/projectcapsule/capsule/security/advisories/GHSA-68cj-mvg9-rgm2

Published

Jul 30, 2026

Last Modified

Jul 31, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65827Docmost is open-source collaborative wiki and documentation …6.5
• CVE-2026-65828Zammad is a web based open source helpdesk/customer support …2.3
• CVE-2026-65829MPXJ is an open source library to read and write project pla…5.3
• CVE-2026-6583A vulnerability has been found in TransformerOptimus SuperAG…5.4
• CVE-2026-65831ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-ro…7.7
• CVE-2026-65832Deskflow is a keyboard and mouse sharing app. Prior to conti…8.2
• CVE-2026-65835Capsule is a multi-tenancy and policy-based framework for Ku…6.6
• CVE-2026-65838Skipper is an HTTP router and reverse proxy for service comp…8.2
• CVE-2026-6584A vulnerability was found in TransformerOptimus SuperAGI up …5.4
• CVE-2026-65841Jodit Editor is a WYSIWYG editor with a built-in file browse…5.3
• CVE-2026-65842Plate is a rich-text editor with AI and shadcn/ui. Prior to …8.2
• CVE-2026-6585A vulnerability was determined in TransformerOptimus SuperAG…5.4