CVE Intelligence
Analysis AI-assisted

CVE-2026-22872: Capsule Kubernetes TenantResource RawItems Privilege Escalation

CVE-2026-22872 affects the Capsule multi-tenancy framework for Kubernetes before 0.13.0. A tenant owner could abuse the controller's cluster-admin privileges through TenantResource RawItems to create cluster-scoped resources that the tenant could not create directly. The fix is available in 0.13.0, and the sources consulted show no confirmed exploitation in the wild.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Capsule is a multi-tenancy and policy-based framework for Kubernetes. According to the GitHub security advisory, the TenantResource RawItems processing logic forces the namespace, but this does not work for cluster-scoped resources. The vulnerability is tracked as CVE-2026-22872 and is classified under CWE-20 (Improper Input Validation).

Impact

  • The Capsule Controller runs with cluster-admin privileges by default.
  • A user with Tenant Owner privileges may cause cluster-scoped resources, such as ClusterRole and ValidatingWebhookConfiguration, to be created even though the tenant cannot create them directly.
  • The record describes cross-tenant privilege escalation and cluster-level impact.
  • Some clusters may have additional admission controllers that block malicious resources, which limits the practical risk in those environments.

Affected products and versions

  • Projectcapsule Capsule, before 0.13.0.
  • Go module github.com/projectcapsule/capsule, before 0.13.0.
  • The fixed version listed in the sources is 0.13.0.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is documented there. The sources consulted do not confirm exploitation in the wild. The record's SSVC data indicates a proof-of-concept exploitation level and that the issue is automatable, which is a risk signal, not evidence of active attacks.

Remediation and mitigation

  • Upgrade Capsule to version 0.13.0 or later, as stated in the official advisory.
  • Until the upgrade is complete, review which users hold Tenant Owner roles and limit that role to trusted administrators.
  • Review admission control policies to confirm that cluster-scoped resource creation by tenants is restricted.

Detection guidance

  • Review Kubernetes audit logs for creation of cluster-scoped resources, such as RBAC roles and admission webhook configurations, that originate from Capsule-managed tenants.
  • Review TenantResource objects for unexpected entries that reference cluster-scoped kinds.
  • Monitor for changes to admission webhook configurations and cluster role bindings that are not part of approved change processes.

Limitations of the available information

The record does not provide a detailed technical root-cause analysis, a list of exploit conditions beyond those described, or any confirmed exploitation timeline. The CVSS base score in NVD is 9.1, while a score of 6.9 is listed by GitHub under a newer CVSS framework; the record does not explain the difference. Fix details beyond the 0.13.0 version are not provided in the record.

Frequently asked questions

Which Capsule versions are affected by CVE-2026-22872?

According to the record, Capsule versions before 0.13.0 are affected, including the Go module github.com/projectcapsule/capsule.

Is this vulnerability being actively exploited?

The CISA KEV catalog does not list this CVE in the record, and the sources consulted do not confirm exploitation in the wild.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.