Capsule stores configuration data for Kubernetes node metadata. In versions prior to 0.13.8 the regex strings in CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and ForbiddenAnnotations.Regex were not validated by the admission webhook. A cluster administrator can store an invalid regular expression; when a node admission request triggers the webhook, the string is compiled with regexp.MustCompile, causing a panic that terminates the webhook process. The result is a denial of service for node creation, update, or patch operations, disrupting admission control until the webhook is restarted.

Any Capsule installation version 0.13.7 or earlier is affected. The flaw exists whenever CapsuleConfiguration objects are allowed to be created or modified by a cluster administrator. The issue is fixed in Capsule release 0.13.8 and later.

The CVSS score of 6.8 classifies the vulnerability as medium severity. EPSS indicates a very low likelihood of exploitation, with a score below 1%. The flaw is not listed in the CISA KEV catalog, so no publicly known exploits are available. Exploitation requires privileged access to modify CapsuleConfiguration objects and authentication of node admission requests, limiting the risk to environments where such permissions are granted.