CVE-2026-65835 Details
Description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the ResourceReference.LoadResources and IsNamespacedGVK cluster-scoped resource rejection guard used by NamespacedItems, allowing a Tenant Owner to create cluster-scoped resources such as ClusterRole or ValidatingWebhookConfiguration through the cluster-admin controller client. This issue is fixed in version 0.13.8.
A vulnerability in Capsule versions 0.13.0 to 0.13.7 allows Tenant Owners to create cluster-scoped resources, such as ClusterRoles or ValidatingWebhookConfigurations, through the TenantResource RawItems and Generators features. This issue arises because the necessary guards to prevent such actions were not applied, leaving a gap that could be exploited to escalate privileges to cluster-admin level. The vulnerability persists despite an attempted fix in a previous version, as the RawItems and Generators paths were overlooked.
Upgrade to Capsule version 0.13.8, where this vulnerability has been addressed by applying the necessary cluster-scope rejection guards to the RawItems and Generators paths.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/projectcapsule/capsule/security/advisories/GHSA-jr6p-8pjj-mfx6 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/projectcapsule/capsule/releases/tag/v0.13.8 | [email protected] | Release NotesVendor |
| https://github.com/projectcapsule/capsule/security/advisories/GHSA-jr6p-8pjj-mfx6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capsule | >= 0.13.0, <= 0.13.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |