by Kastro
Paper/Archive/CVE-2025-55205

CVE-2025-55205

projectcapsule capsule — Capsule tenant owners with "patch namespace" permission can hijack system namespaces label

EPSS 0.5%public exploitCVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 39.9.399 × 208.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially accessing cross-tenant resources through TenantResource selectors. This vulnerability enables privilege escalation and violates the fundamental security boundaries that Capsule is designed to enforce. This vulnerability is fixed in 0.10.4.

Affected

ProductAffectedFixed inSource
capsule< 0.10.4–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/projectcapsule/capsule/security/advisories/GHSA-fcpm-6mxq-m5vvrefgithub.com/projectcapsule/capsule/commit/e1f47feade6e1695b2204407607d07c3b3994f6e