Cross-Tenant Privilege Escalation in Capsule Kubernetes Framework

CVE-2026-22872

What is CVE-2026-22872?

Capsule, a multi-tenancy and policy-based framework for Kubernetes, has a vulnerability allowing tenant administrators to exploit the Capsule Controller's elevated privileges. This issue, present in versions prior to 0.13.0, permits the creation of cluster-scoped resources, such as ClusterRole and ValidatingWebhookConfiguration, which would normally be restricted. The misuse of these capabilities can lead to cross-tenant privilege escalation, potentially enabling malicious actors to execute cluster-level attacks. It is important to note that this vulnerability requires Tenant Owner privileges and that certain configurations may have additional admission controllers in place to mitigate the threat. Upgrade to version 0.13.0 to resolve this critical issue.

References