Capsule, a Kubernetes multi‑tenancy framework, contained an incomplete fix for a prior CVE that allowed tenant owners to create cluster‑scoped resources through the internal controller. The flaw resides in TenantResource RawItems and Generators handling functions, which bypass the usual namespace validation guard. An attacker who is a tenant owner can submit resources such as ClusterRole or ValidatingWebhookConfiguration, granting them cluster‑wide permissions they should not possess, thereby achieving cross‑tenant privilege escalation.

Project Capsule Capsule versions 0.13.0 through 0.13.7 are vulnerable; the issue is corrected in version 0.13.8. No other vendors or products are listed as affected.

The CVSS score of 6.6 indicates medium severity, and the EPSS score is less than 1%, implying low expected exploitation frequency. The vulnerability is not in the CISA KEV catalog. The likely attack vector requires a tenant‑owner who can access the cluster‑admin controller client. If such a user submits a raw resource, the vulnerable code creates it at cluster scope, enabling unauthorized cluster‑wide actions.