PT-2026-66597

CVE-2026-65835

Published

2026-07-30

Updated

2026-09-04

Description by

CVSS 3.1

6.6

Medium

MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Capsule versions 0.13.0 through 0.13.7

Description TenantResource RawItems and Generators in internal/controllers/resources/collect.go, specifically within the handleRawItem() and handleGeneratorItem() functions, fail to apply the ResourceReference.LoadResources and IsNamespacedGVK cluster-scoped resource rejection guards. This allows a Tenant Owner to create cluster-scoped resources, such as ClusterRole or ValidatingWebhookConfiguration, by leveraging the cluster-admin controller client.

Recommendations Update to version 0.13.8.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

CWE-269: Improper Privilege Management

Related identifiers

CVE-2026-65835