CVE-2026-61672

Name of the Vulnerable Software and Affected Versions Capsule versions prior to 0.13.7

Description An issue exists in the ForbiddenListSpec.ExactMatch() function within pkg/api/forbidden list.go where denied metadata keys are sorted case-insensitively but then searched using a byte-order binary search via sort.SearchStrings. When a forbidden list contains a mix of uppercase and lowercase keys, the binary search may fail to find a key that is actually present, returning a false negative.

An authenticated tenant owner can exploit this by passing a forbidden key through the api.ValidateForbidden() function to bypass restrictions on namespace, Service, or delegated node metadata. This could allow a tenant to influence cluster policies, increase network exposure, or affect scheduling outside their tenant boundary by setting forbidden labels or annotations (e.g., Pod Security Admission labels or cloud LoadBalancer annotations).

Recommendations Update Capsule to version 0.13.7. As a temporary workaround, ensure that all keys in the forbidden lists are uniformly lowercase to avoid the sorting discrepancy.