CVE-2026-30963: Capsule Namespace Hijacking via Subresource Webhook Bypass

Technical summary

Capsule enforces multi-tenancy boundaries in Kubernetes via a ValidatingWebhookConfiguration that validates namespace update operations. The vulnerability stems from incomplete webhook interceptor rules: while the webhook covers the main namespace API, it does not define rules for the namespace/status and namespace/finalize subresources. These subresources can modify namespace metadata, including fields used for tenant assignment and isolation. A tenant administrator possessing RBAC permissions to patch or update these subresources can exploit this gap to perform namespace hijacking—reassigning a namespace or its metadata to escape their intended tenant boundary. The vulnerability is classified as CWE-20 (Improper Input Validation).

Business impact

In a multi-tenant Kubernetes environment, this vulnerability allows a tenant administrator to escalate privilege and access resources outside their assigned tenant scope. The blast radius depends on cluster configuration: if tenant admins have broad permissions, one compromised or malicious admin could disrupt neighboring tenants' workloads, access their secrets, or pollute shared infrastructure. For organizations using Capsule to enforce hard tenant isolation (e.g., serving multiple customers or business units on one cluster), exploitation could result in data exposure, service interruption, and compliance violations. The risk is heightened in environments where tenant admins are external users or contractors with limited trust.

Affected systems

All versions of Capsule prior to 0.13.0 are affected. The vulnerability requires the attacker to hold a tenant administrator role and have RBAC permissions to modify namespace/status or namespace/finalize subresources. This is a configuration-dependent risk: organizations that grant these subresource permissions to tenant admins face higher exposure. Version 0.13.0 and later remediate the issue by extending webhook interception rules to cover both subresources.

Exploitability

Exploitation requires three conditions: (1) the environment must run Capsule before version 0.13.0, (2) the attacker must be authenticated as a tenant administrator with RBAC permissions to patch or update namespace/status or namespace/finalize, and (3) the webhook must not have been manually augmented with rules covering these subresources. The CVSS score of 3.9 (LOW) reflects the requirement for high privilege, user interaction, and restricted scope. This is not a remote code execution vulnerability and cannot be exploited by unauthenticated users or those outside the Kubernetes API. However, the attack is deterministic once preconditions are met—no special tooling or complex techniques are required.

Remediation

Upgrade Capsule to version 0.13.0 or later to receive the patch. Organizations unable to upgrade immediately can implement a manual workaround by modifying their ValidatingWebhookConfiguration to add interception rules for the namespace/status and namespace/finalize subresources, blocking unauthorized modifications. Review tenant administrator RBAC bindings to ensure only necessary subresource permissions are granted; restrict access to namespace/status and namespace/finalize to system administrators where possible.

Patch guidance

Upgrade to Capsule version 0.13.0 or a later release. Verify the upgrade in a staging environment to confirm webhook rule changes do not interfere with legitimate namespace management workflows. Confirm that tenant administrators can still perform required namespace operations (labels, annotations) through standard namespace update APIs, and only privileged system administrators can modify status or finalize subresources. Test RBAC policies to ensure the fix does not break multi-tenant workloads.

Detection guidance

Monitor Kubernetes audit logs for PATCH or UPDATE requests to namespace/status or namespace/finalize subresources originating from tenant administrator accounts. Alert on modifications to namespace ownership or tenant assignment fields via these subresources, particularly if they diverge from the tenant administrator's declared namespace scope. Compare the Capsule webhook rule configuration against the current version's documented rules; missing namespace/status or namespace/finalize entries indicate a gap. Use kubectl to inspect the ValidatingWebhookConfiguration resource and verify all relevant subresources are listed.

Why prioritize this

Although the CVSS score is LOW, the vulnerability should be addressed in multi-tenant Kubernetes environments where tenant isolation is a security boundary. The exploit path is direct and does not require complex attack chains or social engineering. However, deployment context matters: standalone or single-tenant Capsule clusters face negligible risk, while shared multi-customer infrastructure should prioritize this patch. The June 2026 publication date and absence from the KEV catalog indicate this is not currently weaponized at scale.

Risk score, explained

The CVSS 3.1 score of 3.9 reflects a LOW severity due to the combination of high privilege requirement (PR:H), high attack complexity (AC:H), user interaction (UI:R), and limited scope of impact (S:U). The attacker must hold tenant administrator credentials and have explicit RBAC permissions. The vector restricts impact to confidentiality, integrity, and availability only for the tenant's own namespace scope, not the broader cluster. This rating is appropriate for a privilege escalation flaw affecting a subset of users in a specific configuration, but organizations with strict multi-tenant boundaries may assess local risk higher than the base score suggests.

Frequently asked questions