CVE-2026-22872: Capsule TenantResource RawItems Cluster-Scoped… (CVSS 6.9)

CVE List Score used 6.9

Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

Capsule is a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin privileges. Although the TenantResource RawItems processing logic forcibly sets the namespace, this is ineffective for cluster-scoped resources. Prior to version 0.13.0, tenant administrators can leverage the Controller's elevated privileges to create cluster-scoped resources (such as ClusterRole and ValidatingWebhookConfiguration) that they cannot create directly, achieving cross-tenant privilege escalation and cluster-level attacks. The attack vector has a few limiting factors. This attack requires Tenant Owner privileges and requires Capsule Controller running with cluster-admin privileges (default configuration). Additionally, some clusters may have additional admission controllers blocking malicious resources. Version 0.13.0 patches this issue.

Record: CVE-2026-22872
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P
Weakness: CWE-20, CWE-863
Updated: 2026-11-02

EUVDEUVD-2026-33729 6.9

Capsule is a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin privileges. Although the TenantResource RawItems processing logic forcibly sets the namespace, this is ineffective for cluster-scoped resources. Prior to version 0.13.0, tenant administrators can leverage the Controller's elevated privileges to create cluster-scoped resources (such as ClusterRole and ValidatingWebhookConfiguration) that they cannot create directly, achieving cross-tenant privilege escalation and cluster-level attacks. The attack vector has a few limiting factors. This attack requires Tenant Owner privileges and requires Capsule Controller running with cluster-admin privileges (default configuration). Additionally, some clusters may have additional admission controllers blocking malicious resources. Version 0.13.0 patches this issue.

Record: EUVD-2026-33729
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-qjjm-7j9w-pw72 6.9

Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

Summary

The Capsule Controller runs with cluster-admin privileges. Although the TenantResource RawItems processing logic forcibly sets the namespace, this is ineffective for cluster-scoped resources. Tenant administrators can leverage the Controller's elevated privileges to create cluster-scoped resources (such as ClusterRole and ValidatingWebhookConfiguration) that they cannot create directly, achieving cross-tenant privilege escalation and cluster-level attacks.

Details

Vulnerability Location

File: internal/controllers/resources/processor.go Function: HandleSection() Lines: 247-285

Core Issues

Excessive Controller Privileges: The Controller's ServiceAccount is bound to the cluster-admin ClusterRole
```
# ClusterRoleBinding: capsule-manager-rolebinding
roleRef:
  kind: ClusterRole
  name: cluster-admin
```
Missing Resource Scope Validation: Although the code calls obj.SetNamespace(ns.Name), this is ineffective for cluster-scoped resources (ClusterRole, ValidatingWebhookConfiguration, etc.), as the Kubernetes API ignores this field
Missing Resource Type Validation: No check for whether resources are cluster-scoped

Vulnerable Code Analysis

// internal/controllers/resources/processor.go
for rawIndex, item := range spec.RawItems {
    template := string(item.Raw)

    t := fasttemplate.New(template, "{{ ", " }}")
    tmplString := t.ExecuteString(map[string]interface{}{
        "tenant.name": tnt.Name,
        "namespace":   ns.Name,
    })

    obj, keysAndValues := unstructured.Unstructured{}, []interface{}{"index", rawIndex}

    // Issue 1: Accepts any resource type, including cluster-scoped resources
    if _, _, decodeErr := codecFactory.UniversalDeserializer().Decode(
        []byte(tmplString), nil, &obj); decodeErr != nil {
        log.Error(decodeErr, "unable to deserialize rawItem", keysAndValues...)
        syncErr = errors.Join(syncErr, decodeErr)
        continue
    }

    // Issue 2: For cluster-scoped resources, this setting is ignored by API
    obj.SetNamespace(ns.Name)

    // Issue 3: Controller creates with cluster-admin privileges, no scope check
    if rawErr := r.createOrUpdate(ctx, &obj, objLabels, objAnnotations); rawErr != nil {
        log.Info("unable to sync rawItem", keysAndValues...)
        syncErr = errors.Join(syncErr, rawErr)
    }
}

Attack Chain

Tenant Owner (bob) - Has TenantResource creation permission
  ↓
Creates TenantResource containing cluster-scoped resources
  ↓
Capsule Controller (cluster-admin) processes RawItems
  ↓
obj.SetNamespace() ignored by Kubernetes API (cluster-scoped resources have no namespace)
  ↓
Successfully creates cluster-scoped resources (ClusterRole, ValidatingWebhook, etc.)
  ↓
Cross-tenant privilege escalation / Cluster-level attacks

PoC

Environment Setup

Test Environment: Kubernetes 1.27+ cluster (verified using Kind cluster)

Step 1: Verify Capsule Controller Privileges

kubectl get clusterrolebinding capsule-manager-rolebinding -o yaml

Confirm output contains:

roleRef:
  kind: ClusterRole
  name: cluster-admin  # Controller has full cluster management privileges

Step 2: Install Capsule and Create Test Tenant

Complete Capsule installation and tenant creation following previous environment setup steps.

Step 3: Verify bob's Permission Restrictions

Verify bob can create TenantResource:

kubectl auth can-i create tenantresources --as bob --as-group projectcapsule.dev -n tenant-b-ns1

Actual output:

yes

Verify bob cannot create ClusterRole:

kubectl auth can-i create clusterroles --as bob --as-group projectcapsule.dev

Actual output:

Warning: resource 'clusterroles' is not namespace scoped in group 'rbac.authorization.k8s.io'

no

**Verify bob cannot create…

Record: GHSA-qjjm-7j9w-pw72
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P
Weakness: CWE-20, CWE-863
Updated: 2026-11-02

NVD 6.9

Capsule is a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin privileges. Although the TenantResource RawItems processing logic forcibly sets the namespace, this is ineffective for cluster-scoped resources. Prior to version 0.13.0, tenant administrators can leverage the Controller's elevated privileges to create cluster-scoped resources (such as ClusterRole and ValidatingWebhookConfiguration) that they cannot create directly, achieving cross-tenant privilege escalation and cluster-level attacks. The attack vector has a few limiting factors. This attack requires Tenant Owner privileges and requires Capsule Controller running with cluster-admin privileges (default configuration). Additionally, some clusters may have additional admission controllers blocking malicious resources. Version 0.13.0 patches this issue.

Record: CVE-2026-22872
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-20, CWE-863
Updated: 2026-11-02

OSV 6.9

Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

Capsule is a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin privileges. Although the TenantResource RawItems processing logic forcibly sets the namespace, this is ineffective for cluster-scoped resources. Prior to version 0.13.0, tenant administrators can leverage the Controller's elevated privileges to create cluster-scoped resources (such as ClusterRole and ValidatingWebhookConfiguration) that they cannot create directly, achieving cross-tenant privilege escalation and cluster-level attacks. The attack vector has a few limiting factors. This attack requires Tenant Owner privileges and requires Capsule Controller running with cluster-admin privileges (default configuration). Additionally, some clusters may have additional admission controllers blocking malicious resources. Version 0.13.0 patches this issue.

Record: CVE-2026-22872
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P
Weakness: CWE-20, CWE-863
Updated: 2026-11-02

OSVGHSA-qjjm-7j9w-pw72 6.9

Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

Summary

The Capsule Controller runs with cluster-admin privileges. Although the TenantResource RawItems processing logic forcibly sets the namespace, this is ineffective for cluster-scoped resources. Tenant administrators can leverage the Controller's elevated privileges to create cluster-scoped resources (such as ClusterRole and ValidatingWebhookConfiguration) that they cannot create directly, achieving cross-tenant privilege escalation and cluster-level attacks.

Details

Vulnerability Location

File: internal/controllers/resources/processor.go Function: HandleSection() Lines: 247-285

Core Issues

Excessive Controller Privileges: The Controller's ServiceAccount is bound to the cluster-admin ClusterRole
```
# ClusterRoleBinding: capsule-manager-rolebinding
roleRef:
  kind: ClusterRole
  name: cluster-admin
```
Missing Resource Scope Validation: Although the code calls obj.SetNamespace(ns.Name), this is ineffective for cluster-scoped resources (ClusterRole, ValidatingWebhookConfiguration, etc.), as the Kubernetes API ignores this field
Missing Resource Type Validation: No check for whether resources are cluster-scoped

Vulnerable Code Analysis

// internal/controllers/resources/processor.go
for rawIndex, item := range spec.RawItems {
    template := string(item.Raw)

    t := fasttemplate.New(template, "{{ ", " }}")
    tmplString := t.ExecuteString(map[string]interface{}{
        "tenant.name": tnt.Name,
        "namespace":   ns.Name,
    })

    obj, keysAndValues := unstructured.Unstructured{}, []interface{}{"index", rawIndex}

    // Issue 1: Accepts any resource type, including cluster-scoped resources
    if _, _, decodeErr := codecFactory.UniversalDeserializer().Decode(
        []byte(tmplString), nil, &obj); decodeErr != nil {
        log.Error(decodeErr, "unable to deserialize rawItem", keysAndValues...)
        syncErr = errors.Join(syncErr, decodeErr)
        continue
    }

    // Issue 2: For cluster-scoped resources, this setting is ignored by API
    obj.SetNamespace(ns.Name)

    // Issue 3: Controller creates with cluster-admin privileges, no scope check
    if rawErr := r.createOrUpdate(ctx, &obj, objLabels, objAnnotations); rawErr != nil {
        log.Info("unable to sync rawItem", keysAndValues...)
        syncErr = errors.Join(syncErr, rawErr)
    }
}

Attack Chain

Tenant Owner (bob) - Has TenantResource creation permission
  ↓
Creates TenantResource containing cluster-scoped resources
  ↓
Capsule Controller (cluster-admin) processes RawItems
  ↓
obj.SetNamespace() ignored by Kubernetes API (cluster-scoped resources have no namespace)
  ↓
Successfully creates cluster-scoped resources (ClusterRole, ValidatingWebhook, etc.)
  ↓
Cross-tenant privilege escalation / Cluster-level attacks

PoC

Environment Setup

Test Environment: Kubernetes 1.27+ cluster (verified using Kind cluster)

Step 1: Verify Capsule Controller Privileges

kubectl get clusterrolebinding capsule-manager-rolebinding -o yaml

Confirm output contains:

roleRef:
  kind: ClusterRole
  name: cluster-admin  # Controller has full cluster management privileges

Step 2: Install Capsule and Create Test Tenant

Complete Capsule installation and tenant creation following previous environment setup steps.

Step 3: Verify bob's Permission Restrictions

Verify bob can create TenantResource:

kubectl auth can-i create tenantresources --as bob --as-group projectcapsule.dev -n tenant-b-ns1

Actual output:

yes

Verify bob cannot create ClusterRole:

kubectl auth can-i create clusterroles --as bob --as-group projectcapsule.dev

Actual output:

Warning: resource 'clusterroles' is not namespace scoped in group 'rbac.authorization.k8s.io'

no

**Verify bob cannot create…

Record: GHSA-qjjm-7j9w-pw72
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P
Weakness: CWE-20, CWE-863
Updated: 2026-11-02

OSVGO-2026-5584 No score

Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

Record: GO-2026-5584
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21483-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
GO-2026-5933 GHSA-3g4q-2f67-2gvh
GO-2026-5934 GHSA-59qp-cfj3-rp64
GO-2026-5935 GHSA-7856-g3gv-9wq8
GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
GO-2026-5942 CVE-2026-46600
GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
GO-2026-5969 GHSA-g936-7jqj-mwv8
GO-2026-5970 CVE-2026-56852
GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
GO-2026-5981 GHSA-mqxv-9rm6-w8qc
GO-2026-5982 GHSA-pqg7-v6wh-3pfp
GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
GO-2026-5985 GHSA-7rx3-5wx3-5v76
GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…

Record: openSUSE-SU-2026:21483-1
Updated: 2026-11-02

Package	Affected	Fixed
`github.com/projectcapsule/capsule` Go	before 0.13.0	0.13.0
`govulncheck-vulndb` openSUSE:Leap 16.0	before 0.0.20260723T184607-160000.1.1	0.0.20260723T184607-160000.1.1

CVE-2026-22872

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

Summary

Details

Vulnerability Location

Core Issues

Vulnerable Code Analysis

Attack Chain

PoC

Environment Setup

Step 1: Verify Capsule Controller Privileges

Step 2: Install Capsule and Create Test Tenant

Step 3: Verify bob's Permission Restrictions

TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability

Summary

Details

Vulnerability Location

Core Issues

Vulnerable Code Analysis

Attack Chain

PoC

Environment Setup

Step 1: Verify Capsule Controller Privileges

Step 2: Install Capsule and Create Test Tenant

Step 3: Verify bob's Permission Restrictions

Affected products

Affected packages

History

In short

References