CVE-2026-30963

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30963", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T17:53:48.814Z", "datePublished": "2026-06-01T18:00:43.797Z", "dateUpdated": "2026-06-02T14:06:11.444Z"}, "containers": {"cna": {"title": "Capsule Namespace Hijacking via subresource", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-2ww6-hf35-mfjm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-2ww6-hf35-mfjm"}, {"name": "https://github.com/projectcapsule/capsule/releases/tag/v0.13.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/projectcapsule/capsule/releases/tag/v0.13.0"}], "affected": [{"vendor": "projectcapsule", "product": "capsule", "versions": [{"version": "< 0.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-01T18:00:43.797Z"}, "descriptions": [{"lang": "en", "value": "Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and namespace/status subresource APIs can also modify various fields of a namespace, including the metadata field. Prior to version 0.13.0, the webhook does not define interception rules for these subresources. As a result, if a tenant administrator has permission to modify namespace/status or namespace/finalize, they can successfully perform namespace hijacking. Version 0.13.0 fixes the issue. Another mitigation is to add two subresources (namespaces and snamespaces/status with namespace/finalize within it) to the resources list in the ValidatingWebhookConfiguration rules."}], "source": {"advisory": "GHSA-2ww6-hf35-mfjm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-2ww6-hf35-mfjm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-02T14:04:59.231575Z", "id": "CVE-2026-30963", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T14:06:11.444Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30963", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T14:04:59.231575Z"}}}], "references": [{"url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-2ww6-hf35-mfjm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T14:04:32.772Z"}}], "cna": {"title": "Capsule Namespace Hijacking via subresource", "source": {"advisory": "GHSA-2ww6-hf35-mfjm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.9, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "projectcapsule", "product": "capsule", "versions": [{"status": "affected", "version": "< 0.13.0"}]}], "references": [{"url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-2ww6-hf35-mfjm", "name": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-2ww6-hf35-mfjm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/projectcapsule/capsule/releases/tag/v0.13.0", "name": "https://github.com/projectcapsule/capsule/releases/tag/v0.13.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and namespace/status subresource APIs can also modify various fields of a namespace, including the metadata field. Prior to version 0.13.0, the webhook does not define interception rules for these subresources. As a result, if a tenant administrator has permission to modify namespace/status or namespace/finalize, they can successfully perform namespace hijacking. Version 0.13.0 fixes the issue. Another mitigation is to add two subresources (namespaces and snamespaces/status with namespace/finalize within it) to the resources list in the ValidatingWebhookConfiguration rules."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-01T18:00:43.797Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30963", "state": "PUBLISHED", "dateUpdated": "2026-06-02T14:06:11.444Z", "dateReserved": "2026-03-07T17:53:48.814Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-01T18:00:43.797Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "capsule", "vendor": "projectcapsule", "versions": [{"status": "affected", "version": "< 0.13.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:projectcapsule:capsule:*:*:*:*:*:*:*:*", "matchCriteriaId": "A7404B12-5E27-4AB9-80C0-82901F2AA44B", "versionEndExcluding": "0.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a webhook to validate update requests targeting namespaces. However, in Kubernetes, the namespace/finalize and namespace/status subresource APIs can also modify various fields of a namespace, including the metadata field. Prior to version 0.13.0, the webhook does not define interception rules for these subresources. As a result, if a tenant administrator has permission to modify namespace/status or namespace/finalize, they can successfully perform namespace hijacking. Version 0.13.0 fixes the issue. Another mitigation is to add two subresources (namespaces and snamespaces/status with namespace/finalize within it) to the resources list in the ValidatingWebhookConfiguration rules."}, {"lang": "es", "value": "Capsule es un framework multi-inquilino y basado en pol\u00edticas para Kubernetes. Para defenderse contra el secuestro de espacios de nombres logrado a trav\u00e9s de operaciones de actualizaci\u00f3n/parche en los espacios de nombres, Capsule utiliza un webhook para validar las solicitudes de actualizaci\u00f3n dirigidas a los espacios de nombres. Sin embargo, en Kubernetes, las API de subrecursos namespace/finalize y namespace/status tambi\u00e9n pueden modificar varios campos de un espacio de nombres, incluido el campo de metadatos. Antes de la versi\u00f3n 0.13.0, el webhook no define reglas de intercepci\u00f3n para estos subrecursos. Como resultado, si un administrador de inquilinos tiene permiso para modificar namespace/status o namespace/finalize, puede realizar con \u00e9xito el secuestro de espacios de nombres. La versi\u00f3n 0.13.0 corrige el problema. Otra mitigaci\u00f3n es a\u00f1adir dos subrecursos (namespaces y snamespaces/status con namespace/finalize dentro de \u00e9l) a la lista de recursos en las reglas de ValidatingWebhookConfiguration."}], "id": "CVE-2026-30963", "lastModified": "2026-07-22T07:10:00.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30963", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-02T14:04:59.231575Z", "version": "2.0.3"}}]}, "published": "2026-06-01T19:16:22.780", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/projectcapsule/capsule/releases/tag/v0.13.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-2ww6-hf35-mfjm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-2ww6-hf35-mfjm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.13.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "capsule", "source": "cna", "vendor": "projectcapsule"}, "product": "capsule", "vendor": "projectcapsule"}], "created": "2026-06-01T20:30:16.530781+00:00", "updated": "2026-06-03T21:30:32.708198+00:00", "vendors": ["projectcapsule", "projectcapsule$PRODUCT$capsule"]}