projectcapsule has 7 CVEs on record between 2023 and 2026. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 4. The median CVSS is 6.8 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-863 (3). Most affected products: capsule (4), github.com/projectcapsule/capsule (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Products
- capsule 4
- github.com/projectcapsule/capsule 3
Worst active — by depth score
CVE-2026-61672High· 7.1Capsule is a multi-tenancy and policy-based framework for Kubernetes51CVE-2026-61794Medium· 6.8Capsule is a multi-tenancy and policy-based framework for Kubernetes50CVE-2026-61795Medium· 6.8Capsule is a multi-tenancy and policy-based framework for Kubernetes38CVE-2026-65834Medium· 6.8Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests37CVE-2026-65835Medium· 6.6Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)36
projectcapsule vulnerabilities
CVEs affecting projectcapsule, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-61794Medium· 6.8PoCCapsule is a multi-tenancy and policy-based framework for Kubernetes
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the…
CVE-2026-61795Medium· 6.8Capsule is a multi-tenancy and policy-based framework for Kubernetes
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validate…
CVE-2026-61672High· 7.1PoCCapsule is a multi-tenancy and policy-based framework for Kubernetes
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assume…
CVE-2026-55636Medium· 5.7Capsule is a multi-tenancy and policy-based framework for Kubernetes
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name…
CVE-2026-65834Medium· 6.8Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
CVE-2026-65835Medium· 6.6Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)
Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)
CVE-2023-46254Medium· 4.3capsule-proxy service discloses Namespaces of colliding tenants to owners of different tenants with the same ServiceAccount name
capsule-proxy service discloses Namespaces of colliding tenants to owners of different tenants with the same ServiceAccount name