CVE-2026-65835 | CyberRota

CyberRota Analysis

AI-Generated

A vulnerability in Capsule versions 0.13.0 to 0.13.8 allows Tenant Owners to create cluster-scoped resources, such as ClusterRole or ValidatingWebhookConfiguration, due to inadequate enforcement of resource rejection guards. This could lead to unauthorized privilege escalation within a Kubernetes environment. Organizations using affected versions of Capsule should prioritize upgrading to version 0.13.8 to mitigate potential security risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-65835

Severity

MEDIUM

CVSS

6.6

EPSS

0.19%

Kubernetes

Original NVD Description

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the ResourceReference.LoadResources and IsNamespacedGVK cluster-scoped resource rejection guard used by NamespacedItems, allowing a Tenant Owner to create cluster-scoped resources such as ClusterRole or ValidatingWebhookConfiguration through the cluster-admin controller client. This issue is fixed in version 0.13.8.