CVE-2026-65835 Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)
Tenant owners can escalate privileges to create cluster-scoped resources like ClusterRoles due to missing validation in Capsule's resource handling logic.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-65835?
CVE-2026-65835 is a medium-severity vulnerability in projectcapsule capsule, published on 30 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the ResourceReference.LoadResources and IsNamespacedGVK cluster-scoped resource rejection guard used by NamespacedItems, allowing a Tenant Owner to create cluster-scoped resources such as ClusterRole or ValidatingWebhookConfiguration through the cluster-admin controller client. This issue is fixed in version 0.13.8.
Which versions are affected by CVE-2026-65835?
3 open source packages ship an affected version, including github.com/projectcapsule/capsule.
| Package | Affected | Fixed in |
|---|---|---|
github.com/projectcapsule/capsule Go | From 0.13.0 | 0.13.8 |
github.com/projectcapsule/capsule Go | From 0.13.0 | 0.13.8 |
github.com/projectcapsule/capsule Go | From 0.13.0 | 0.13.8 |
How do I fix CVE-2026-65835?
Upgrade github.com/projectcapsule/capsule to 0.13.8 or later.
Is CVE-2026-65835 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65835 exists.
Sources
Also known as GHSA-jr6p-8pjj-mfx6, GO-2026-6157.