Critical severity9.0OSV Advisory· Published Aug 18, 2025· Updated Apr 15, 2026
CVE-2025-55205
CVE-2025-55205
Description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially accessing cross-tenant resources through TenantResource selectors. This vulnerability enables privilege escalation and violates the fundamental security boundaries that Capsule is designed to enforce. This vulnerability is fixed in 0.10.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/projectcapsule/capsuleGo | < 0.10.4 | 0.10.4 |
Affected products
2- Range: 0.0.1, 0.2.0-rc1, helm-v0.1.0, …
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-fcpm-6mxq-m5vvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-55205ghsaADVISORY
- github.com/projectcapsule/capsule/commit/e1f47feade6e1695b2204407607d07c3b3994f6envdWEB
- github.com/projectcapsule/capsule/security/advisories/GHSA-fcpm-6mxq-m5vvnvdWEB
- pkg.go.dev/vuln/GO-2025-3893ghsaWEB
News mentions
0No linked articles in our index yet.