CVE-2026-65834

Name of the Vulnerable Software and Affected Versions Capsule versions prior to 0.13.8

Description The configuration admission webhook fails to validate the CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex variables. This allows a Cluster Admin to store a malformed regular expression that is subsequently processed by the regexp.MustCompile() function in pkg/api/forbidden list.go via internal/webhook/node/user metadata.go. Consequently, this can cause the node admission webhook to crash during Node create, update, or patch requests.

Recommendations Update to version 0.13.8.