Capsule enforces namespace policy through a validating webhook, but before version 0.13.0 the webhook omitted rules for the namespace/status and namespace/finalize subresources. Because these subresources can modify namespace metadata, a tenant administrator with permission to update them could bypass the webhook and change critical namespace attributes, effectively hijacking the namespace. The vulnerability is a classic input validation error (CWE‑20) that allows callers to supply data that the system does not properly guard against. This leads to confidentiality, integrity, and availability impacts for the affected namespace, giving the attacker full control over namespace configuration and potentially other tenant resources.

All installations of Capsule prior to version 0.13.0 are affected, including governance of Kubernetes clusters where tenant administrators have the ability to modify namespace/status or namespace/finalize subresources.

The CVSS score of 3.9 reflects the low impact when the attacker is limited to tenant‑level privileges, but the absence of subresource validation creates a clear attack path. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting limited known exploitation in the wild. Nonetheless, any actor who can alter namespace subresources can exploit this weakness; therefore, the likelihood of exploitation remains significant in environments that grant such permissions. Mitigation requires patching or reconfiguring the webhook to include the missing subresource rules, as described in the advisory.