Projectcapsule
Monthly
Privilege escalation in Capsule (Kubernetes multi-tenancy framework) versions 0.13.0-0.13.7 allows authenticated Tenant Owners to break out of tenant isolation and create cluster-scoped Kubernetes resources - including ClusterRole, ClusterRoleBinding, and ValidatingWebhookConfiguration - through the cluster-admin controller client. This is an incomplete fix of CVE-2026-22872: the TenantResource RawItems and Generators code paths (handleRawItem, handleGeneratorItem) were never updated to enforce the same cluster-scoped resource rejection guards applied to NamespacedItems. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v0.13.8 is available.
Capsule's node admission webhook can be crashed cluster-wide by a Cluster Admin who stores a malformed regular expression in CapsuleConfiguration's NodeMetadata fields, causing a Go panic via regexp.MustCompile that blocks all subsequent Node create, update, and patch operations. All Capsule versions prior to 0.13.8 are affected, as confirmed by GitHub Security Advisory GHSA-68cj-mvg9-rgm2. No public exploit has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that the crash cascades beyond the vulnerable Capsule component to impair node admission cluster-wide.
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Privilege escalation in Capsule (Kubernetes multi-tenancy framework) versions 0.13.0-0.13.7 allows authenticated Tenant Owners to break out of tenant isolation and create cluster-scoped Kubernetes resources - including ClusterRole, ClusterRoleBinding, and ValidatingWebhookConfiguration - through the cluster-admin controller client. This is an incomplete fix of CVE-2026-22872: the TenantResource RawItems and Generators code paths (handleRawItem, handleGeneratorItem) were never updated to enforce the same cluster-scoped resource rejection guards applied to NamespacedItems. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v0.13.8 is available.
Capsule's node admission webhook can be crashed cluster-wide by a Cluster Admin who stores a malformed regular expression in CapsuleConfiguration's NodeMetadata fields, causing a Go panic via regexp.MustCompile that blocks all subsequent Node create, update, and patch operations. All Capsule versions prior to 0.13.8 are affected, as confirmed by GitHub Security Advisory GHSA-68cj-mvg9-rgm2. No public exploit has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that the crash cascades beyond the vulnerable Capsule component to impair node admission cluster-wide.
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.