CVE-2024-39690

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39690
Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant (i.e., namespaces without the ownerReference field), thereby gaining control of that namespace. Version 0.7.1 contains a patch.

8.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/projectcapsule/capsule/commit/d620b0457ddec01616b8eab8512a10611611f584 Patch
https://github.com/projectcapsule/capsule/security/advisories/GHSA-mq69-4j5w-3qwp Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:projectcapsule:capsule:*:*:*:*:*:*:*:*
History

14 Aug 2025, 14:15

Type Values Removed Values Added
Summary (en) Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant (i.e., namespaces without the ownerReference field), thereby gaining control of that namespace. (en) Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant (i.e., namespaces without the ownerReference field), thereby gaining control of that namespace. Version 0.7.1 contains a patch.
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 8.4

21 Aug 2024, 16:01

Type Values Removed Values Added
CPE cpe:2.3:a:projectcapsule:capsule:*:*:*:*:*:*:*:*
First Time Projectcapsule capsule
Projectcapsule
CVSS v2 : unknown
v3 : 8.4 		v2 : unknown
v3 : 8.8
References () https://github.com/projectcapsule/capsule/commit/d620b0457ddec01616b8eab8512a10611611f584 - () https://github.com/projectcapsule/capsule/commit/d620b0457ddec01616b8eab8512a10611611f584 - Patch
References () https://github.com/projectcapsule/capsule/security/advisories/GHSA-mq69-4j5w-3qwp - () https://github.com/projectcapsule/capsule/security/advisories/GHSA-mq69-4j5w-3qwp - Exploit
Summary
  • (es) Capsule es un framework multiinquilino y basado en políticas para Kubernetes. En Capsule v0.7.0 y versiones anteriores, el inquilino-propietario puede parchear cualquier espacio de nombres arbitrario que no haya sido asumido por un inquilino (es decir, espacios de nombres sin el campo propietarioReferencia), obteniendo así el control de ese espacio de nombres.

20 Aug 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-20 15:15

Updated : 2025-08-14 14:15

NVD link : CVE-2024-39690

Mitre link : CVE-2024-39690

CVE.ORG link : CVE-2024-39690

JSON object : View

Products Affected

projectcapsule

  • capsule
CWE
CWE-863

Incorrect Authorization