{"items":[{"id":"NVI-00016313","kind":"vulnerability","title":"Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f94q-w3w8-cj67","CVE-2026-61795"],"plain_summary":"GitHub lists this reviewed advisory for github.com/projectcapsule/capsule. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-674d9fa7305016005e45ba1d906e85dd"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-18T17:14:48.000Z","value":"6.8 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-674d9fa7305016005e45ba1d906e85dd"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-674d9fa7305016005e45ba1d906e85dd","url":"https://github.com/advisories/GHSA-f94q-w3w8-cj67","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f94q-w3w8-cj67","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T14:29:49.409Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-674d9fa7305016005e45ba1d906e85dd"],"technology":"github.com/projectcapsule/capsule","known_exclusions":[],"conditions_summary":"### Summary\n\nA parameter order bug in `internal/webhook/tenant/validation/hostname_regex.go` causes the `hostnameRegexHandler.OnUpdate` webhook to validate the **old** Tenant object's `AllowedHostnames.Regex` instead of the **new** one being submitted. This allows an invalid (malformed) regex to bypass admission validation and be persisted to etcd, causing a Denial of Service for all Ingress operations within the affected tenant.\n\n### Details\n\nThe `TypedHandler[T]` interface defines `OnUpdate` as:\n\n```go\n// handlers.go\nOnUpdate(c client.Client, reader client.Reader, obj T, old T, decoder admission.Decoder, recorder events.EventRecorder) Func\n//                                               ^^^ NEW  ^^^ OLD\n```\n\nThe dispatcher in `handler.go:93` calls:\n```go\nhndl.OnUpdate(c, reader, tnt, old, decoder, recorder)\n//                        ^^^ NEW  ^^^ OLD\n```\n\nHowever, `hostnameRegexHandler.OnUpdate` in `hostname_regex.go` declares its parameters in **reversed order**:\n\n```go\n// hostname_regex.go (BUGGY)\nfunc (h *hostnameRegexHandler) OnUpdate(\n    _ client.Client,\n    _ client.Reader,\n    old *capsulev1beta2.Tenant,   // ← receives NEW tenant (mislabeled as old)\n    tnt *capsulev1bet","public_affected_ranges":[">= 0.13.0, < 0.13.7"]}],"null_published_at":"2026-11-04T10:04:27.930Z","source_updated_at":"2026-09-18T17:14:48.000Z","source_disclosed_at":"2026-09-18T17:14:43.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T14:29:49.409Z"}],"next_cursor":null,"snapshot_revision":"40769"}