CVE-2026-65834

CVE-2026-65834 in Capsule operator exposes a regex validation gap that creates cluster-wide operational fragility. The vulnerability lives in the `ForbiddenLabels.Regex` configuration field, which uses `regexp.MustCompile` at webhook invocation time rather than validating the regex pattern when the configuration is written. Here's the practical problem: a Cluster Admin can write invalid regex to this field, the configuration passes validation and stores successfully, and the webhook only crashes when someone attempts a node operation. The failure is deferred from config time to trigger time, which means the error surfaces during an incident rather than during cluster setup. The blast radius is asymmetric. The Cluster Admin who wrote bad regex experiences no immediate consequence—the crash happens to every tenant attempting node operations, regardless of whether they had any involvement in the configuration decision. One admin's configuration mistake becomes cluster-wide denial of service for uninvolved users. This is the operational risk that elevates this beyond a simple input validation bug. The fix in version 0.13.8 adds runtime validation at config write time using `validation.IsValidRegex()`. This is a one-line addition, which is itself informative—the vulnerability existed not because of architectural complexity but because a single validation call was missing. Audit your Capsule deployment: identify any other configuration fields that accept regex patterns, expressions, or templates and verify they have write-time validation. Check other admission controllers in your environment for the same pattern—configuration inputs from privileged users that defer validation until runtime and create cluster-wide failure potential when misconfigured. The question isn't just 'is this patched' but 'where else does this deferred-validation topology exist in my admission stack.'

Reviewed through automated stages and approved by a human before publication.