Executive brief
Capsule is a framework used to manage multiple users (tenants) within a single Kubernetes cluster. A security flaw allows a tenant administrator to bypass their restricted permissions and create powerful, cluster-wide resources that they should not have access to. This could allow an attacker to take full control of the entire cluster, access data from other tenants, or disrupt operations across the entire organization.
Technical details
A privilege escalation vulnerability exists in the Capsule Controller's TenantResource processing logic. The controller runs with cluster-admin privileges and processes 'RawItems' defined in a TenantResource. While the controller attempts to enforce multi-tenancy by calling obj.SetNamespace() on these items, this call is ignored by the Kubernetes API for cluster-scoped resources (e.g., ClusterRole, ValidatingWebhookConfiguration). An attacker with Tenant Owner privileges can submit a TenantResource containing these cluster-scoped objects, which the controller then creates using its elevated service account. This allows the attacker to create a cluster-admin ClusterRole or malicious webhooks, effectively gaining full control over the Kubernetes cluster. The issue is patched in version 0.13.0.
Affected products
- Project Capsule Capsule <= v0.12.4
Timeline
- 2026-05-28: patched: Version 0.13.0 released
- 2026-05-28: advisory: GitHub Security Advisory GHSA-qjjm-7j9w-pw72 published
- 2026-06-01: disclosed: CVE-2026-22872 published to NVD