High severity8.4NVD Advisory· Published Aug 20, 2024· Updated Jun 17, 2026

CVE-2024-39690

Description

Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant (i.e., namespaces without the ownerReference field), thereby gaining control of that namespace. Version 0.7.1 contains a patch.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/projectcapsule/capsuleGo	< 0.7.1	0.7.1

Affected products

Projectcms/Capsule2 versions
cpe:2.3:a:projectcapsule:capsule:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:projectcapsule:capsule:*:*:*:*:*:*:*:*range: <=0.7.0
- (no CPE)range: <= 0.7.0
ghsa-coords
pkg:golang/github.com/projectcapsule/capsule
Range: < 0.7.1

Patches

Vulnerability mechanics

References

github.com/projectcapsule/capsule/commit/d620b0457ddec01616b8eab8512a10611611f584nvdPatchWEB
github.com/projectcapsule/capsule/security/advisories/GHSA-mq69-4j5w-3qwpnvdExploitWEB
github.com/advisories/GHSA-mq69-4j5w-3qwpghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-39690ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.546
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000