Capsule
Monthly
Privilege escalation in Capsule (Kubernetes multi-tenancy framework) versions 0.13.0-0.13.7 allows authenticated Tenant Owners to break out of tenant isolation and create cluster-scoped Kubernetes resources - including ClusterRole, ClusterRoleBinding, and ValidatingWebhookConfiguration - through the cluster-admin controller client. This is an incomplete fix of CVE-2026-22872: the TenantResource RawItems and Generators code paths (handleRawItem, handleGeneratorItem) were never updated to enforce the same cluster-scoped resource rejection guards applied to NamespacedItems. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v0.13.8 is available.
Capsule's node admission webhook can be crashed cluster-wide by a Cluster Admin who stores a malformed regular expression in CapsuleConfiguration's NodeMetadata fields, causing a Go panic via regexp.MustCompile that blocks all subsequent Node create, update, and patch operations. All Capsule versions prior to 0.13.8 are affected, as confirmed by GitHub Security Advisory GHSA-68cj-mvg9-rgm2. No public exploit has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that the crash cascades beyond the vulnerable Capsule component to impair node admission cluster-wide.
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
capsule-proxy is a reverse proxy for Capsule kubernetes multi-tenancy framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Privilege escalation in Capsule (Kubernetes multi-tenancy framework) versions 0.13.0-0.13.7 allows authenticated Tenant Owners to break out of tenant isolation and create cluster-scoped Kubernetes resources - including ClusterRole, ClusterRoleBinding, and ValidatingWebhookConfiguration - through the cluster-admin controller client. This is an incomplete fix of CVE-2026-22872: the TenantResource RawItems and Generators code paths (handleRawItem, handleGeneratorItem) were never updated to enforce the same cluster-scoped resource rejection guards applied to NamespacedItems. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v0.13.8 is available.
Capsule's node admission webhook can be crashed cluster-wide by a Cluster Admin who stores a malformed regular expression in CapsuleConfiguration's NodeMetadata fields, causing a Go panic via regexp.MustCompile that blocks all subsequent Node create, update, and patch operations. All Capsule versions prior to 0.13.8 are affected, as confirmed by GitHub Security Advisory GHSA-68cj-mvg9-rgm2. No public exploit has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that the crash cascades beyond the vulnerable Capsule component to impair node admission cluster-wide.
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
capsule-proxy is a reverse proxy for Capsule kubernetes multi-tenancy framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.