https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T21:47:45.672989+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-343459 EUVD-2026-343459 2026-10-05T21:47:45.729842+00:00 EUVD-2026-343459 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65835 fkie_cve-2026-65835 2026-10-05T21:47:45.729886+00:00

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the ResourceReference.LoadResources and IsNamespacedGVK cluster-scoped resource rejection guard used by NamespacedItems, allowing a Tenant Owner to create cluster-scoped resources such as ClusterRole or ValidatingWebhookConfiguration through the cluster-admin controller client. This issue is fixed in version 0.13.8.

 https://cve.radiocsirt.org/vuln/ghsa-jr6p-8pjj-mfx6 GHSA-jr6p-8pjj-mfx6 — Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped reso… 2026-10-05T21:47:45.729923+00:00

Affected: Go: github.com/projectcapsule/capsule

### Summary CVE-2026-22872 (GHSA-qjjm-7j9w-pw72) reported that a Tenant Owner could create cluster-scoped resources (e.g. `ClusterRole`, `ValidatingWebhookConfiguration`) through a `TenantResource`, because the controller applies them with its cluster-admin ServiceAccount and `SetNamespace` is ineffective for cluster-scoped kinds. The v0.13.0 fix added a cluster-scope rejection guard, but **only on the NamespacedItems selection path** (`ResourceReference.LoadResources` -> `IsNamespacedGVK`, error `"cluster-scoped kind ... is not allowed"`). The **RawItems create path — the exact vector the original advisory named — and the Generators path were not given this guard.** The vulnerability therefore persists in all releases **v0.13.0 through v0.13.7** and on trunk HEAD (`8d89d6865d`).

### Details TenantResource reconcile flow: - `internal/controllers/resources/namespaced.go` `reconcile()` obtains the apply client via `loadClient()`; by default (impersonation off, no `Spec.ServiceAccount`) this is the manager client whose SA is bound to cluster-admin (`charts/capsule/templates/rbac.yaml:488-501`, `{fullname}-manager-rolebinding` -> roleRef cluster-admin). - `Collector.Collect()` (`collect.go`) processes `spec.RawItems` via `handleRawItem` and `spec.Generators` via `handleGeneratorItem`.

`handleRawItem` (`collect.go:406-425`, trunk HEAD — byte-identical to v0.13.0): ```go tmplString := tpl.FastTemplate(string(item.Raw), opts.Iterator.FastContext) obj := &unstructured.Unst…