Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC can send a PUT request to /api/v1/namespaces/{namespace}/finalize, and the singular rule never matches the plural resource, so the validating webhook is not invoked and the user can change the namespace tenant label. matchPolicy: Equivalent does not compensate because it handles API group and version equivalence rather than resource-name errors.
This vulnerability is fixed in 0.13.6.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
High
Admin privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
High
Complete data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/projectcapsule/capsule/commit/af2f37793e789b2301da8ed8dfb52a…
security-advisories@github.com
https://github.com/projectcapsule/capsule/pull/1966
security-advisories@github.com
https://github.com/projectcapsule/capsule/releases/tag/v0.13.6
security-advisories@github.com
https://github.com/projectcapsule/capsule/security/advisories/GHSA-gwxr-7h77-77…
security-advisories@github.com