CVE-2026-55636

Name of the Vulnerable Software and Affected Versions Capsule version 0.13.2

Description A typo in the webhook rules of the software causes a failure in the defense mechanism for the namespaces/finalize subresource. The configuration uses the singular namespace/finalize instead of the plural namespaces/finalize required by Kubernetes. Because Kubernetes admission webhooks match against plural resource names, the singular rule never matches actual API requests, and the matchPolicy: Equivalent setting does not compensate for this typo. This allows a user with RBAC permissions for namespaces/finalize to bypass the admission webhook by sending a PUT request to the /api/v1/namespaces/<ns>/finalize endpoint, potentially leading to a namespace tenant-label hijack.

Recommendations Update Capsule to a version where the namespace/finalize rule is corrected to namespaces/finalize in the charts/capsule/templates/configuration.yaml file.