The vulnerability occurs in Capsule, a Kubernetes multi‑tenancy framework, when the TenantResource RawItems component ignores namespace enforcement for cluster‑scoped resources. Because the Capsule Controller runs with cluster‑admin privileges, a tenant administrator who owns the tenant can instruct the controller to create cluster‑scoped objects such as ClusterRole and ValidatingWebhookConfiguration. This enables the tenant to gain privileges and attack the cluster that they are normally prohibited from accessing, leading to a full cross‑tenant privilege escalation and potential cluster‑level compromise.

Capsule v0.13.0 and earlier are affected. Users deploying Capsule on Kubernetes clusters with the default controller configuration should review the version they are running; any version prior to 0.13.0 is vulnerable.

The CVSS score of 6.9 indicates a moderate‑to‑high severity. No EPSS score is available, but the CVE notes that the exploit requires Tenant Owner privileges and a Capsule Controller running with cluster‑admin rights, limiting the attack surface to environments that use the default configuration. The vulnerability is not listed in the KEV catalog, suggesting no known public exploits yet. However, the attack path is straightforward: an authorized tenant administrator can trigger cluster‑scoped resource creation through the controller, bypassing normal admission controls if they exist.