CVE-2026-65835 is a privilege management vulnerability in projectcapsule's capsule framework affecting versions prior to 0.13.8. The vulnerability arises because TenantResource RawItems and Generators in internal/controllers/resources/collect.go did not apply the ResourceReference.LoadResources and IsNamespacedGVK cluster-scoped resource rejection guard, unlike NamespacedItems. This omission allows a Tenant Owner to create cluster-scoped resources such as ClusterRole or ValidatingWebhookConfiguration via the cluster-admin controller client, potentially escalating privileges within the Kubernetes cluster. The issue was introduced after an incomplete fix for CVE-2026-22872 and is fixed in version 0.13.8.

An authenticated Tenant Owner can create cluster-scoped resources that should be restricted, such as ClusterRole or ValidatingWebhookConfiguration. This can lead to privilege escalation and unauthorized modification of cluster-wide configurations, impacting confidentiality, integrity, and availability of the Kubernetes environment. The CVSS 3.1 base score is 6.6 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impacts to confidentiality, integrity, and availability with scope change.

Upgrade to projectcapsule capsule version 0.13.8 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Patch status is not explicitly stated as 'official-fix' or 'temporary-fix' in the advisory, but the description confirms the issue is fixed in 0.13.8. Until upgrade, restrict Tenant Owner privileges to minimize risk.