PT-2025-33668 · Capsule · Capsule

B0B0Haha · Published 2025-08-18 · Updated 2025-09-24 · CVE-2025-55205

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Capsule versions prior to 0.10.4

Description: Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection issue in earlier versions allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system). This bypasses multi-tenant isolation and potentially enables access to cross-tenant resources through TenantResource selectors, leading to privilege escalation and violating Capsule’s security boundaries.

Recommendations: Upgrade to version 0.10.4.

Exploit

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-55205

GHSA-FCPM-6MXQ-M5VV

GO-2025-3893

Affected Products

Capsule

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55205.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55205 · Security Note
• https://osv.dev/vulnerability/GO-2025-3893 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55205 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fcpm-6mxq-m5vv · Vendor Advisory
• https://github.com/projectcapsule/capsule · Note
• https://github.com/projectcapsule/capsule/commit/e1f47feade6e1695b2204407607d07c3b3994f6e · Note
• https://github.com/projectcapsule/capsule/security/advisories/GHSA-fcpm-6mxq-m5vv · Note
• https://twitter.com/CrowdCyber_Com/status/1957840199901188139 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1957644128017346735 · Twitter Post
• https://twitter.com/cracbot/status/1959209050601861249 · Twitter Post
• https://pkg.go.dev/vuln/GO-2025-3893 · Note
• https://twitter.com/Komodosec/status/1970912507289292934 · Twitter Post
• https://t.me/CVEtracker/30286 · Telegram Post
• https://twitter.com/fridaysecurity/status/1957644892114493554 · Twitter Post