Is CVE-2026-22872 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22872 being exploited in the wild.

How severe is CVE-2026-22872?

Medium severity, with a CVSS score of 4, published 1 June 2026.

Which products and versions are affected?

github.com/projectcapsule/capsule (Go) < 0.13.0, SEMVER:introduced=0,fixed=0.13.0; Project Capsule Capsule < 0.13.0, <= v0.12.4.

Is there a fix for CVE-2026-22872?

Yes. github.com/projectcapsule/capsule (Go): upgrade to 0.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22872 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-22872?

Check whether you run github.com/projectcapsule/capsule (Go) or Project Capsule Capsule at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22872: Project Capsule privilege escalation via cluster-scoped TenantResource items

Q: Is there a fix for CVE-2026-22872?

Yes. github.com/projectcapsule/capsule (Go): upgrade to 0.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-22872 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-22872?

Check whether you run github.com/projectcapsule/capsule (Go) or Project Capsule Capsule at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22872 · Severity: medium · CVSS 4 · Published 2026-06-01

Capsule is a framework used to manage multiple users (tenants) within a single Kubernetes cluster. A security flaw allows a tenant administrator to bypass their restricted permissions and create powerful, cluster-wide resources that they should not have access to. This could allow an attacker to take full control of the entire cluster, access data from other tenants, or disrupt operations across the entire organization.

Technologies: github.com/projectcapsule/capsule (Go), Project Capsule Capsule. Vendors: Go, Project Capsule.

Quick answers

Is CVE-2026-22872 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22872 being exploited in the wild.
How severe is CVE-2026-22872?: Medium severity, with a CVSS score of 4, published 1 June 2026.
Which products and versions are affected?: github.com/projectcapsule/capsule (Go) < 0.13.0, SEMVER:introduced=0,fixed=0.13.0; Project Capsule Capsule < 0.13.0, <= v0.12.4.
Is there a fix for CVE-2026-22872?: Yes. github.com/projectcapsule/capsule (Go): upgrade to 0.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22872 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-22872?: Check whether you run github.com/projectcapsule/capsule (Go) or Project Capsule Capsule at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/projectcapsule/capsule (Go): upgrade to 0.13.0 or later
```
go get github.com/projectcapsule/capsule@v0.13.0
```

Technical details

A privilege escalation vulnerability exists in the Capsule Controller's TenantResource processing logic. The controller runs with cluster-admin privileges and processes 'RawItems' defined in a TenantResource. While the controller attempts to enforce multi-tenancy by calling obj.SetNamespace() on these items, this call is ignored by the Kubernetes API for cluster-scoped resources (e.g., ClusterRole, ValidatingWebhookConfiguration). An attacker with Tenant Owner privileges can submit a TenantResource containing these cluster-scoped objects, which the controller then creates using its elevated service account. This allows the attacker to create a cluster-admin ClusterRole or malicious webhooks, effectively gaining full control over the Kubernetes cluster. The issue is patched in version 0.13.0.

Affected products

Project Capsule Capsule <= v0.12.4

Identifiers

CVE-2026-22872
GHSA-qjjm-7j9w-pw72
GO-2026-5584

Timeline

2026-05-28: patched: Version 0.13.0 released
2026-05-28: advisory: GitHub Security Advisory GHSA-qjjm-7j9w-pw72 published
2026-06-01: disclosed: CVE-2026-22872 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.