CVE-2026-65835
Summary
CVE-2026-22872 (GHSA-qjjm-7j9w-pw72) reported that a Tenant Owner could create cluster-scoped resources
(e.g. ClusterRole, ValidatingWebhookConfiguration) through a TenantResource, because the controller
applies them with its cluster-admin ServiceAccount and SetNamespace is ineffective for cluster-scoped
kinds. The v0.13.0 fix added a cluster-scope rejection guard, but only on the NamespacedItems selection
path (ResourceReference.LoadResources -> IsNamespacedGVK, error `"cluster-scoped kind ... is not
allowed"`). The RawItems create path — the exact vector the original advisory named — and the Generators
path were not given this guard. The vulnerability therefore persists in all releases v0.13.0 through
v0.13.7 and on trunk HEAD (8d89d6865d).
Details
TenantResource reconcile flow:
- internal/controllers/resources/namespaced.go reconcile() obtains the apply client via loadClient();
by default (impersonation off, no Spec.ServiceAccount) this is the manager client whose SA is bound to
cluster-admin (charts/capsule/templates/rbac.yaml:488-501, {fullname}-manager-rolebinding ->
roleRef cluster-admin).
- Collector.Collect() (collect.go) processes spec.RawItems via handleRawItem and spec.Generators
via handleGeneratorItem.
handleRawItem (collect.go:406-425, trunk HEAD — byte-identical to v0.13.0):
tmplString := tpl.FastTemplate(string(item.Raw), opts.Iterator.FastContext)
obj := &unstructured.Unstructured{}
unstructured.UnstructuredJSONScheme.Decode([]byte(tmplString), nil, obj)
if ns != nil { obj.SetNamespace(ns.Name) } // ONLY mitigation
return obj, nil // NO IsNamespacedGVK / allowClusterScoped guard
handleGeneratorItem (collect.go:382-404) is the same: it only SetNamespaces on rendered objects.
The accumulated objects flow to pkg/api/processor/processor_func.go Reconcile() -> Apply() ->
clt.PatchApply(ctx, c, obj, ...) (line 167/378) with no scope check at any point.
By contrast, CollectNamespacedItems (collect.go:308) calls item.LoadResources(..., allowC
⚡ Watch CVE-2026-65835
Get an email if CVE-2026-65835 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-65835)