Is CVE-2026-65835 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65835 being exploited in the wild.

How severe is CVE-2026-65835?

Medium severity, with a CVSS score of 6.6, published 30 July 2026.

Which products and versions are affected?

github.com/projectcapsule/capsule (Go) >= 0.13.0, <= 0.13.7, SEMVER:introduced=0.13.0,fixed=0.13.8.

Is there a fix for CVE-2026-65835?

Yes. github.com/projectcapsule/capsule (Go): upgrade to 0.13.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65835 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65835?

Check whether you run github.com/projectcapsule/capsule (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65835: Project Capsule privilege escalation in TenantResource controller

Q: Is there a fix for CVE-2026-65835?

Yes. github.com/projectcapsule/capsule (Go): upgrade to 0.13.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-65835 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-65835?

Check whether you run github.com/projectcapsule/capsule (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65835 · Severity: medium · CVSS 6.6 · Published 2026-07-30

Capsule, a multi-tenancy tool for Kubernetes, contains a vulnerability that allows a tenant owner to bypass security restrictions and create cluster-wide resources. By exploiting this flaw, an attacker with limited access to a single tenant can escalate their privileges to become a cluster administrator. This could lead to a total compromise of the entire Kubernetes cluster, including access to sensitive data and control over all other tenants.

Technologies: github.com/projectcapsule/capsule (Go). Vendors: Go.

Quick answers

Is CVE-2026-65835 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65835 being exploited in the wild.
How severe is CVE-2026-65835?: Medium severity, with a CVSS score of 6.6, published 30 July 2026.
Which products and versions are affected?: github.com/projectcapsule/capsule (Go) >= 0.13.0, <= 0.13.7, SEMVER:introduced=0.13.0,fixed=0.13.8.
Is there a fix for CVE-2026-65835?: Yes. github.com/projectcapsule/capsule (Go): upgrade to 0.13.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65835 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65835?: Check whether you run github.com/projectcapsule/capsule (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/projectcapsule/capsule (Go): upgrade to 0.13.8 or later
```
go get github.com/projectcapsule/capsule@v0.13.8
```

Technical details

A vulnerability exists in Capsule where the fix for CVE-2026-22872 was incomplete. While a cluster-scope rejection guard was added to the NamespacedItems selection path, it was omitted from the RawItems and Generators creation paths in the TenantResource controller. An attacker with Tenant Owner privileges can submit a TenantResource containing cluster-scoped objects (like ClusterRoles or ValidatingWebhookConfigurations) in the 'rawItems' or 'generators' fields. Because the controller applies these resources using its own high-privilege ServiceAccount and the Kubernetes API ignores namespace settings for cluster-scoped objects, the attacker achieves cluster-admin equivalent privileges. This issue is patched in version 0.13.8.

Affected products

Project Capsule Capsule >= 0.13.0, <= 0.13.7

Identifiers

CVE-2026-65835
GHSA-jr6p-8pjj-mfx6
GO-2026-6157

Timeline

2026-07-08: disclosed: Advisory published by project maintainers
2026-07-08: patched: Fixed in version 0.13.8
2026-07-30: advisory: NVD published CVE-2026-65835

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.