CVE-2025-55205: Projectcapsule Capsule

Critical severity, CVSS 9.0. EPSS: 0.5% chance of exploitation in the next 30 days.

Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially accessing cross-tenant resources through TenantResource selectors. This vulnerability enables privilege escalation and violates the fundamental security boundaries that Capsule is designed to enforce. This vulnerability is fixed in 0.10.4.

Affected products

Published 2025-08-18. Last modified 2026-06-17.