# CVE-2026-22872: Project Capsule privilege escalation via cluster-scoped TenantResource items

Source: https://junglewise.ai/threats/cve-2026-22872-project-capsule-privilege-escalation-via-cluster-scoped  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-22872 · Severity: medium · CVSS 4 · Published 2026-06-01

Capsule is a framework used to manage multiple users (tenants) within a single Kubernetes cluster. A security flaw allows a tenant administrator to bypass their restricted permissions and create powerful, cluster-wide resources that they should not have access to. This could allow an attacker to take full control of the entire cluster, access data from other tenants, or disrupt operations across the entire organization.

Technologies: [github.com/projectcapsule/capsule (Go)](https://junglewise.ai/threats/technologies/github-com-projectcapsule-capsule), [Project Capsule Capsule](https://junglewise.ai/threats/technologies/capsule). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Project Capsule](https://junglewise.ai/threats/vendors/project-capsule).

## Quick answers

**Is CVE-2026-22872 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22872 being exploited in the wild.

**How severe is CVE-2026-22872?** Medium severity, with a CVSS score of 4, published 1 June 2026.

**Which products and versions are affected?** github.com/projectcapsule/capsule (Go) < 0.13.0, SEMVER:introduced=0,fixed=0.13.0; Project Capsule Capsule < 0.13.0, <= v0.12.4.

**Is there a fix for CVE-2026-22872?** Yes. github.com/projectcapsule/capsule (Go): upgrade to 0.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22872 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-22872?** Check whether you run github.com/projectcapsule/capsule (Go) or Project Capsule Capsule at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/projectcapsule/capsule (Go): upgrade to 0.13.0 or later

  ```sh
  go get github.com/projectcapsule/capsule@v0.13.0
  ```


## Technical details

A privilege escalation vulnerability exists in the Capsule Controller's TenantResource processing logic. The controller runs with cluster-admin privileges and processes 'RawItems' defined in a TenantResource. While the controller attempts to enforce multi-tenancy by calling obj.SetNamespace() on these items, this call is ignored by the Kubernetes API for cluster-scoped resources (e.g., ClusterRole, ValidatingWebhookConfiguration). An attacker with Tenant Owner privileges can submit a TenantResource containing these cluster-scoped objects, which the controller then creates using its elevated service account. This allows the attacker to create a cluster-admin ClusterRole or malicious webhooks, effectively gaining full control over the Kubernetes cluster. The issue is patched in version 0.13.0.

## Affected products

- Project Capsule Capsule <= v0.12.4

## Identifiers

- CVE-2026-22872
- GHSA-qjjm-7j9w-pw72
- GO-2026-5584

## Timeline

- 2026-05-28: patched: Version 0.13.0 released
- 2026-05-28: advisory: GitHub Security Advisory GHSA-qjjm-7j9w-pw72 published
- 2026-06-01: disclosed: CVE-2026-22872 published to NVD

## References

- [https://github.com/projectcapsule/capsule/releases/tag/v0.13.0](https://github.com/projectcapsule/capsule/releases/tag/v0.13.0)
- [https://github.com/projectcapsule/capsule/security/advisories/GHSA-qjjm-7j9w-pw72](https://github.com/projectcapsule/capsule/security/advisories/GHSA-qjjm-7j9w-pw72)

## Related threats

- [Capsule hostnameRegexHandler parameter order bypass in webhook validation](https://junglewise.ai/threats/cve-2026-61795-capsule-hostnameregexhandler-parameter-order-bypass-in-webhook)
- [Capsule Tenant ForbiddenAnnotations.Regex validation bypass](https://junglewise.ai/threats/cve-2026-61794-capsule-tenant-forbiddenannotations-regex-validation-bypass)
- [Capsule forbidden namespace/service/node label and annotation enforcement bypass](https://junglewise.ai/threats/cve-2026-61672-capsule-forbidden-namespace-service-node-label-and-annotation)
- [Clastix Capsule incorrect authorization via typo in namespaces/finalize webhook](https://junglewise.ai/threats/cve-2026-55636-clastix-capsule-incorrect-authorization-via-typo-in-namespaces)
- [Project Capsule privilege escalation in TenantResource controller](https://junglewise.ai/threats/cve-2026-65835-project-capsule-privilege-escalation-in-tenantresource-controller)