{"items":[{"id":"NVI-00018421","kind":"vulnerability","title":"Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-qjjm-7j9w-pw72","CVE-2026-22872"],"plain_summary":"GitHub lists this reviewed advisory for github.com/projectcapsule/capsule. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-20ee1d4c4e277334c714c5b196d0b33f"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-20ee1d4c4e277334c714c5b196d0b33f","url":"https://github.com/advisories/GHSA-qjjm-7j9w-pw72","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-qjjm-7j9w-pw72","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T20:56:39.448Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-20ee1d4c4e277334c714c5b196d0b33f"],"technology":"github.com/projectcapsule/capsule","known_exclusions":[],"conditions_summary":"# TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability\n\n\n## Summary\n\nThe Capsule Controller runs with cluster-admin privileges. Although the TenantResource RawItems processing logic forcibly sets the namespace, this is ineffective for cluster-scoped resources. Tenant administrators can leverage the Controller's elevated privileges to create cluster-scoped resources (such as ClusterRole and ValidatingWebhookConfiguration) that they cannot create directly, achieving cross-tenant privilege escalation and cluster-level attacks.\n\n---\n\n## Details\n\n### Vulnerability Location\n\nFile: `internal/controllers/resources/processor.go`\nFunction: `HandleSection()`\nLines: 247-285\n\n### Core Issues\n\n1. **Excessive Controller Privileges**: The Controller's ServiceAccount is bound to the cluster-admin ClusterRole\n   ```yaml\n   # ClusterRoleBinding: capsule-manager-rolebinding\n   roleRef:\n     kind: ClusterRole\n     name: cluster-admin\n   ```\n\n2. **Missing Resource Scope Validation**: Although the code calls `obj.SetNamespace(ns.Name)`, this is ineffective for cluster-scoped resources (ClusterRole, ValidatingWebhookConfiguration, etc.), as the Kubernetes API ignores this field\n\n3. **Mis","public_affected_ranges":["< 0.13.0"]}],"null_published_at":"2026-11-07T07:07:39.834Z","source_updated_at":"2026-06-09T10:50:47.000Z","source_disclosed_at":"2026-05-28T17:02:55.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T20:56:39.448Z"}],"next_cursor":null,"snapshot_revision":"39771"}