Capsule is a multi-tenancy and policy-based Kubernetes framework whose Controller runs with cluster-admin privileges. Before version 0.13.0, the logic that processes TenantResource RawItems forcibly sets namespaces but fails to restrict creation of cluster-scoped resources. This improper input validation (CWE-20) and insufficient authorization (CWE-863) allow tenant administrators with Tenant Owner privileges to exploit the Controller's elevated privileges to create cluster-scoped resources they cannot normally create, enabling cross-tenant privilege escalation and cluster-wide impact. The attack requires specific conditions including the default cluster-admin privilege of the Capsule Controller and Tenant Owner access. The vulnerability is patched in version 0.13.0.

An attacker with Tenant Owner privileges can leverage the vulnerability to create cluster-scoped resources such as ClusterRole and ValidatingWebhookConfiguration, which can lead to privilege escalation beyond their tenant boundaries and potentially compromise the entire Kubernetes cluster. This undermines the multi-tenancy isolation guarantees of Capsule and can result in cluster-level attacks. The impact is limited by the requirement of Tenant Owner privileges and the default cluster-admin configuration of the Capsule Controller. Additional admission controllers may also reduce the risk.

Upgrade Capsule to version 0.13.0 or later, where this vulnerability is patched. If upgrading immediately is not possible, review and restrict the privileges of the Capsule Controller to avoid running it with cluster-admin rights if feasible. Additionally, implement admission controllers that can block unauthorized creation of cluster-scoped resources. Patch status is not explicitly confirmed in the advisory, but version 0.13.0 is stated to fix the issue, so upgrading is the recommended remediation.