-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key flaws in role_bindings.go: 1) In GetUserNamespacesFromRequest, ServiceAccount usernames were parsed without preserving namespace context, creating ambiguous identifiers. 2) OwnerRoleBindingsIndexFunc constructed index keys without namespace qualification for Subject references. The patch explicitly addresses both by: a) Appending namespace to ServiceAccount usernames (fmt.Sprintf("%s-%s", namespace, name)), and b) Including Subject.Namespace in index key construction when available. These changes directly correlate to the described vulnerability scenario where same-name ServiceAccounts in different namespaces were improperly considered equivalent.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/projectcapsule/capsule | go | <= 0.4.4 | 0.4.5 |
| github.com/projectcapsule/capsule-proxy | go | <= 0.4.4 | 0.4.5 |