CVE-2026-65835

Deferred Deferred - Pending Action

Privilege Escalation in Capsule Kubernetes Framework

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the ResourceReference.LoadResources and IsNamespacedGVK cluster-scoped resource rejection guard used by NamespacedItems, allowing a Tenant Owner to create cluster-scoped resources such as ClusterRole or ValidatingWebhookConfiguration through the cluster-admin controller client. This issue is fixed in version 0.13.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-65835

EUVD

EUVD-2026-51296

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

CVE-2026-65835 is a vulnerability in Capsule, a Kubernetes multi-tenancy framework. It allows a Tenant Owner to create cluster-scoped resources like ClusterRole or ValidatingWebhookConfiguration through improper validation in internal controllers. The issue stems from missing checks in TenantResource RawItems and Generators that should reject cluster-scoped resources.

Detection Guidance

To detect this vulnerability, check if your Capsule version is between 0.13.0 and 0.13.8. Run: kubectl get deployment -n capsule-system -l app.kubernetes.io/name=capsule -o jsonpath='{.items[0].spec.template.spec.containers[0].image}'

Impact Analysis

This vulnerability could allow unauthorized creation of cluster-scoped resources, potentially leading to privilege escalation or misconfiguration in a Kubernetes cluster. An attacker with Tenant Owner access could exploit this to gain broader control over the cluster.

Compliance Impact

The vulnerability allows a Tenant Owner to create cluster-scoped resources like ClusterRole or ValidatingWebhookConfiguration through improper access controls. This could lead to unauthorized privilege escalation or resource manipulation in Kubernetes clusters, potentially violating compliance requirements for data protection and access control in standards like GDPR and HIPAA.

Mitigation Strategies

Upgrade Capsule to version 0.13.8 or later immediately. Run: helm upgrade capsule oci://ghcr.io/projectcapsule/capsule --version 0.13.8

Hi! I’m here to help you understand CVE-2026-65835. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70