CVE-2026-61794

Name of the Vulnerable Software and Affected Versions Capsule versions 0.13.0 through 0.13.6

Description A validation error in internal/webhook/tenant/validation/forbidden annotations regex.go allows a malformed ForbiddenAnnotations.Regex value to bypass validation during a Tenant update. This occurs because the system incorrectly compiles ForbiddenLabels.Regex for both label and annotation checks. When a Namespace is subsequently created or updated, the stored malformed expression is processed by pkg/api/forbidden list.go, where the regexp.MustCompile() function can panic. This leads to a denial of service for namespace operations within the affected tenant.

Recommendations Update to version 0.13.7.