CVE-2025-55205: Critical Flaw in Capsule Kubernetes Exposes Clusters to Cross-Tenant Attacks

A newly disclosed vulnerability in the Capsule Kubernetes multi-tenancy framework exposes organizations to privilege escalation and cross-tenant attacks. Tracked as CVE-2025-55205 with a CVSS score of 9.1, the flaw undermines Capsule’s core promise of tenant isolation, allowing authenticated tenant users to hijack system namespaces.

According to the advisory, “A namespace label injection vulnerability in Capsule v0.10.3 allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially accessing cross-tenant resources through TenantResource selectors.”

The vulnerability originates from Capsule’s namespace validation webhook logic, specifically in pkg/webhook/namespace/validation/patch.go.

The problem lies in a conditional check that only validates tenant ownership when a namespace already has a tenant label:

if label, ok := ns.Labels[ln]; ok {
    // Only checks permissions when namespace has tenant label
    if !utils.IsTenantOwner(tnt.Spec.Owners, req.UserInfo) {
        response := admission.Denied(e)
        return &response
    }
}

return nil  // Critical issue: allows operation if no tenant label exists

Since system namespaces like kube-system and default do not have tenant labels by default, Capsule fails to protect them, allowing attackers to inject arbitrary labels unchecked.

As the advisory highlights, “System namespaces (kube-system, default, capsule-system) do not have the capsule.clastix.io/tenant label by default… authenticated users can inject arbitrary labels into unprotected namespaces.”

The exploitation path can be summarized as:

Label Injection (user-controlled) → Namespace Selector (system matching) → TenantResource/Quota Check (authorization bypass) → Cross-tenant Resource Access

This mirrors the pattern of CVE-2024-39690, but instead of exploiting ownerReference manipulation, attackers exploit label injection to bypass authorization.

The consequences of this vulnerability are severe for organizations running multi-tenant Kubernetes clusters:

• Multi-tenant Isolation Bypass – Attackers can break tenant boundaries and access other tenants’ resources.
• Privilege Escalation – Tenant users can escalate privileges to interact with cluster-wide resources.
• Data Exfiltration – Sensitive data in secrets, configmaps, and certificates within kube-system could be exposed.
• Resource Quota Bypass – Attackers may consume resources beyond their assigned limits.
• Policy Circumvention – Security, network, and governance policies tied to namespace boundaries can be bypassed.

Real-world scenarios include:

• Extracting kube-system secrets (service account tokens, cluster certificates).
• Modifying system configurations, potentially destabilizing the cluster.
• Cross-tenant data theft, leading to compliance violations in shared environments.
• A potential cluster-wide compromise if attackers gain sufficient system-level access.

This flaw affects:

• Organizations running Capsule v0.10.3 or earlier.
• Enterprises and cloud service providers offering Kubernetes-as-a-Service with Capsule.
• Any environment that depends on Capsule for multi-tenant isolation and governance.

Administrators should apply updates as soon as possible.

Related Posts:

• Detecting Lateral Movement Risks in Microsoft Entra ID’s Cross-Tenant Synchronization Feature
• CVE-2024-8856: WP Time Capsule Plugin Vulnerability Exposes 20,000+ Sites to TakeOver
• Ubuntu Security Alert: Three Ways to Bypass User Namespace Restrictions
• Google Chrome will label all HTTP websites as “Not Secure” in July of this year

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Do Son

Do Son (aka Ddos) is a seasoned news reporter, bringing over a decade of expertise to the forefront of cyber security and technology reporting. My work provides timely and insightful analysis of emerging trends and critical developments in these rapidly evolving sectors.