CVE-2024-39690: Capsule tenant owner with "patch namespace" permission can hijack system namespaces

August 20, 2024 (updated August 14, 2025)

The tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant (i.e., namespaces without the ownerReference field), thereby gaining control of that namespace.

I would like to express my apologies once again. I have always been sincere in my research and communication, and I did not intend to disturb you on purpose.

References

github.com/advisories/GHSA-mq69-4j5w-3qwp
github.com/projectcapsule/capsule
github.com/projectcapsule/capsule/commit/d620b0457ddec01616b8eab8512a10611611f584
github.com/projectcapsule/capsule/security/advisories/GHSA-mq69-4j5w-3qwp
nvd.nist.gov/vuln/detail/CVE-2024-39690

Code Behaviors & Features

Detect and mitigate CVE-2024-39690 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →