{"cve":"CVE-2026-55636","nvd":{"published":"2026-09-15T16:17:14.990","modified":"2026-09-30T17:51:56.193","status":"Deferred","description":"Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC can send a PUT request to /api/v1/namespaces/{namespace}/finalize, and the singular rule never matches the plural resource, so the validating webhook is not invoked and the user can change the namespace tenant label. matchPolicy: Equivalent does not compensate because it handles API group and version equivalence rather than resource-name errors. This vulnerability is fixed in 0.13.6.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L","score":5.7},"cwes":["CWE-863"],"references":["https://github.com/projectcapsule/capsule/commit/af2f37793e789b2301da8ed8dfb52ab60affebb6","https://github.com/projectcapsule/capsule/pull/1966","https://github.com/projectcapsule/capsule/releases/tag/v0.13.6","https://github.com/projectcapsule/capsule/security/advisories/GHSA-gwxr-7h77-7777"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-55636","score":0.00385,"percentile":0.32284,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-gwxr-7h77-7777","url":"https://osv.dev/vulnerability/GHSA-gwxr-7h77-7777","summary":"Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected","modified":"2026-06-25T23:11:05.409835877Z","packages":[{"ecosystem":"Go","name":"github.com/projectcapsule/capsule","purl":"pkg:golang/github.com/projectcapsule/capsule","ranges":[">=0.13.0 <0.13.6"],"fixed":["0.13.6"]}]},{"id":"GO-2026-5406","url":"https://osv.dev/vulnerability/GO-2026-5406","summary":"Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule","modified":"2026-06-25T23:00:16.121204900Z","packages":[{"ecosystem":"Go","name":"github.com/projectcapsule/capsule","purl":"pkg:golang/github.com/projectcapsule/capsule","ranges":[">=0.13.0 <0.13.6"],"fixed":["0.13.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}