CVE-2026-61795: Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation
A parameter order bug in internal/webhook/tenant/validation/hostname_regex.go causes the hostnameRegexHandler.OnUpdate webhook to validate the old Tenant object’s AllowedHostnames.Regex instead of the new one being submitted. This allows an invalid (malformed) regex to bypass admission validation and be persisted to etcd, causing a Denial of Service for all Ingress operations within the affected tenant.
References
- github.com/advisories/GHSA-f94q-w3w8-cj67
- github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e
- github.com/projectcapsule/capsule/pull/1983
- github.com/projectcapsule/capsule/releases/tag/v0.13.7
- github.com/projectcapsule/capsule/security/advisories/GHSA-f94q-w3w8-cj67
- nvd.nist.gov/vuln/detail/CVE-2026-61795
Code Behaviors & Features
Detect and mitigate CVE-2026-61795 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →