Capsule TenantResource Cluster-Scoped Privilege Escalation (CVE-2026-2272)

Vulnerability Overview Vulnerability Name: TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability CVE ID: CVE-2026-2272 Severity: High Description: The Capsule Controller runs with cluster-admin privileges. Although the RawItems processing logic forces the setting of a namespace, this is ineffective for cluster-scoped resources. Tenant administrators can exploit the controller's elevated privileges to create cluster-scoped resources (such as and ) that they cannot create directly, thereby achieving cross-tenant privilege escalation and cluster-level attacks. Scope of Impact Affected Versions: <v0.12.4 Fixed Versions: 0.13.0 Impact Scope: All Capsule deployments, provided the following prerequisites are met: 1. The Capsule Controller runs with cluster-admin privileges (default configuration). 2. Tenant owners have permission to create objects. Security Impact: 1. Cross-Tenant Privilege Escalation: - Create to gain cluster-level permissions. - Breach tenant isolation boundaries. - Access all resources of other tenants. 2. Massive Sensitive Data Theft: - Intercept all Secret creation/update requests via malicious Webhooks. - Steal passwords, API keys, certificates, etc., across the entire cluster. - Monitor sensitive operations of all tenants in real-time. 3. Cluster-Level Denial of Service: - Reject all API requests via Webhooks. - Render the entire cluster unavailable. - Affect all tenants. 4. Cluster Pollution: - Create malicious CRDs. - Modify StorageClasses. - Impact cluster stability. 5. Persistent Backdoors: - The created cluster-scoped resources persist. - Even if the is deleted, the and other resources remain. - Difficult to detect and remove. Remediation Fixed Versions: 0.13.0 POC Code Environment Setup Verify Bob's Permission Restrictions Create TenantResource containing a ClusterRole Apply Configuration Verify ClusterRole Creation Create TenantResource containing a Webhook Apply Configuration Verify Webhook Creation Attack Chain 1. Tenant Owner (Bob) - Has permissions to create . 2. Create containing cluster-scoped resources. 3. Capsule Controller (Cluster Admin) processes the . 4. is ignored by the Kubernetes API (cluster-scoped resources do not have a namespace). 5. Successful creation of cluster-scoped resources ( , , etc.). 6. Cross-tenant privilege escalation / Cluster-level attack. Vulnerability Location File: Function: Line Numbers: 247-285 Core Issues 1. Excessive Controller Privileges: The controller's ServiceAccount is bound to the cluster-admin . 2. Lack of Resource Scope Validation: Although the code calls , this is ineffective for cluster-scoped resources (such as and ) because the Kubernetes API ignores this field. 3. Lack of Resource Type Validation: There is no check to determine if the resource is cluster-scoped. Vulnerability Code Analysis Limiting Factors Requires tenant owners to have permissions to create . Requires the Capsule Controller to run with cluster-admin privileges.

Goal Reached Thanks to every supporter — we hit 100%!

Capsule TenantResource Cluster-Scoped Privilege Escalation (CVE-2026-2272)

More from this source