CVE-2026-30963

Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and namespace/status subresource APIs can also modify various fields of a namespace, including the metadata field. Prior to version 0.13.0, the webhook does not define interception rules for these subresources. As a result, if a tenant administrator has permission to modify namespace/status or namespace/finalize, they can successfully perform namespace hijacking. Version 0.13.0 fixes the issue. Another mitigation is to add two subresources (namespaces and snamespaces/status with namespace/finalize within it) to the resources list in the ValidatingWebhookConfiguration rules.

CVSS v3 3.9 LOW

3.9^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.5 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/projectcapsule/capsule/releases/tag/v0.13.0	Product Release Notes
https://github.com/projectcapsule/capsule/security/advisories/GHSA-2ww6-hf35-mfjm	Exploit Mitigation Vendor Advisory
https://github.com/projectcapsule/capsule/security/advisories/GHSA-2ww6-hf35-mfjm	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:projectcapsule:capsule:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-01 19:16

Updated : 2026-07-22 07:10

NVD link : CVE-2026-30963

Mitre link : CVE-2026-30963

CVE.ORG link : CVE-2026-30963

JSON object : View

Products Affected

projectcapsule

capsule

CWE

CWE-20

Improper Input Validation

NVD-CWE-noinfo

{"id": "CVE-2026-30963", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30963", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T14:04:59.231575Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.9, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 0.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "projectcapsule", "product": "capsule", "versions": [{"status": "affected", "version": "< 0.13.0"}]}]}], "published": "2026-06-01T19:16:22.780", "references": [{"url": "https://github.com/projectcapsule/capsule/releases/tag/v0.13.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-2ww6-hf35-mfjm", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-2ww6-hf35-mfjm", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and namespace/status subresource APIs can also modify various fields of a namespace, including the metadata field. Prior to version 0.13.0, the webhook does not define interception rules for these subresources. As a result, if a tenant administrator has permission to modify namespace/status or namespace/finalize, they can successfully perform namespace hijacking. Version 0.13.0 fixes the issue. Another mitigation is to add two subresources (namespaces and snamespaces/status with namespace/finalize within it) to the resources list in the ValidatingWebhookConfiguration rules."}, {"lang": "es", "value": "Capsule es un framework multi-inquilino y basado en pol\u00edticas para Kubernetes. Para defenderse contra el secuestro de espacios de nombres logrado a trav\u00e9s de operaciones de actualizaci\u00f3n/parche en los espacios de nombres, Capsule utiliza un webhook para validar las solicitudes de actualizaci\u00f3n dirigidas a los espacios de nombres. Sin embargo, en Kubernetes, las API de subrecursos namespace/finalize y namespace/status tambi\u00e9n pueden modificar varios campos de un espacio de nombres, incluido el campo de metadatos. Antes de la versi\u00f3n 0.13.0, el webhook no define reglas de intercepci\u00f3n para estos subrecursos. Como resultado, si un administrador de inquilinos tiene permiso para modificar namespace/status o namespace/finalize, puede realizar con \u00e9xito el secuestro de espacios de nombres. La versi\u00f3n 0.13.0 corrige el problema. Otra mitigaci\u00f3n es a\u00f1adir dos subrecursos (namespaces y snamespaces/status con namespace/finalize dentro de \u00e9l) a la lista de recursos en las reglas de ValidatingWebhookConfiguration."}], "lastModified": "2026-07-22T07:10:00.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:projectcapsule:capsule:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7404B12-5E27-4AB9-80C0-82901F2AA44B", "versionEndExcluding": "0.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}