CyberRota Analysis
AI-GeneratedKubernetes users utilizing Capsule versions prior to 0.13.8 are vulnerable due to improper validation of regex patterns in the configuration admission webhook, which can lead to crashes during node creation, updates, or patches. This vulnerability may disrupt cluster operations and impact multi-tenancy management. Cluster administrators should prioritize upgrading to version 0.13.8 to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster Admin to store a malformed regex that later reached regexp.MustCompile in pkg/api/forbidden_list.go through internal/webhook/node/user_metadata.go and crashed the node admission webhook on Node create, update, or patch requests. This issue is fixed in version 0.13.8.