CVE-2025-55205

Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially accessing cross-tenant resources through TenantResource selectors. This vulnerability enables privilege escalation and violates the fundamental security boundaries that Capsule is designed to enforce. This vulnerability is fixed in 0.10.4.

CVSS v3.1

9.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CVSS v3.1

9.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS

0.45% chance of exploitation in the next 30 days, 37th percentile

Published

2025-08-18

Proof-of-concept exploits (1)

• advisories/GHSA-fcpm-6mxq-m5vv

References

• CVE Record
• NVD entry

Related

• CVE-2025-5520
• CVE-2025-55207
• CVE-2025-55194
• CVE-2025-5521
• CVE-2025-55190
• CVE-2025-55212