CVE-2022-46167

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-46167", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "requesterUserId": "c184a3d9-dc98-4c48-a45b-d2d88cf0ac74", "dateReserved": "2022-11-28T17:27:19.998Z", "datePublished": "2022-12-02T18:22:21.817Z", "dateUpdated": "2025-04-23T16:32:56.226Z"}, "containers": {"cna": {"title": "Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm"}, {"name": "https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b", "tags": ["x_refsource_MISC"], "url": "https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b"}, {"name": "https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1", "tags": ["x_refsource_MISC"], "url": "https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1"}, {"name": "https://github.com/clastix/capsule/releases/tag/v0.1.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/clastix/capsule/releases/tag/v0.1.3"}], "affected": [{"vendor": "clastix", "product": "capsule", "versions": [{"version": "< 0.1.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-12-02T18:22:21.817Z"}, "descriptions": [{"lang": "en", "value": "Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted with `PATCH` capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operator and removing all the enforcement like Pod Security annotations, Network Policies, Limit Range and Resource Quota items. An attacker could detach the Namespace from a Tenant that is forbidding starting privileged Pods using the Pod Security labels by removing the OwnerReference, removing the enforcement labels, and being able to start privileged containers that would be able to start a generic Kubernetes privilege escalation. Patches have been released for version 0.1.3. No known workarounds are available.\n"}], "source": {"advisory": "GHSA-x45c-cvp8-q4fm", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:24:03.369Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm"}, {"name": "https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b"}, {"name": "https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1"}, {"name": "https://github.com/clastix/capsule/releases/tag/v0.1.3", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/clastix/capsule/releases/tag/v0.1.3"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T15:46:12.013257Z", "id": "CVE-2022-46167", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T16:32:56.226Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm", "name": "https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b", "name": "https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1", "name": "https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/clastix/capsule/releases/tag/v0.1.3", "name": "https://github.com/clastix/capsule/releases/tag/v0.1.3", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:24:03.369Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-46167", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-23T15:46:12.013257Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T15:46:13.727Z"}}], "cna": {"title": "Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace", "source": {"advisory": "GHSA-x45c-cvp8-q4fm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "clastix", "product": "capsule", "versions": [{"status": "affected", "version": "< 0.1.3"}]}], "references": [{"url": "https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm", "name": "https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b", "name": "https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1", "name": "https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/clastix/capsule/releases/tag/v0.1.3", "name": "https://github.com/clastix/capsule/releases/tag/v0.1.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted with `PATCH` capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operator and removing all the enforcement like Pod Security annotations, Network Policies, Limit Range and Resource Quota items. An attacker could detach the Namespace from a Tenant that is forbidding starting privileged Pods using the Pod Security labels by removing the OwnerReference, removing the enforcement labels, and being able to start privileged containers that would be able to start a generic Kubernetes privilege escalation. Patches have been released for version 0.1.3. No known workarounds are available.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-12-02T18:22:21.817Z"}}}, "cveMetadata": {"cveId": "CVE-2022-46167", "state": "PUBLISHED", "dateUpdated": "2025-04-23T16:32:56.226Z", "dateReserved": "2022-11-28T17:27:19.998Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-12-02T18:22:21.817Z", "requesterUserId": "c184a3d9-dc98-4c48-a45b-d2d88cf0ac74", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "capsule", "vendor": "clastix", "versions": [{"status": "affected", "version": "< 0.1.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:clastix:capsule:*:*:*:*:*:*:*:*", "matchCriteriaId": "65FF754C-955F-4358-82E4-A7DD544D75C3", "versionEndExcluding": "0.1.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted with `PATCH` capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operator and removing all the enforcement like Pod Security annotations, Network Policies, Limit Range and Resource Quota items. An attacker could detach the Namespace from a Tenant that is forbidding starting privileged Pods using the Pod Security labels by removing the OwnerReference, removing the enforcement labels, and being able to start privileged containers that would be able to start a generic Kubernetes privilege escalation. Patches have been released for version 0.1.3. No known workarounds are available.\n"}, {"lang": "es", "value": "Capsule es un framework multiinquilino y basado en pol\u00edticas para Kubernetes. Antes de la versi\u00f3n 0.1.3, una cuenta de servicio implementada en un espacio de nombres de inquilino, cuando se le conced\u00edan capacidades \"PATCH\" en su propio espacio de nombres, pod\u00eda editarla y eliminar la referencia del propietario, rompiendo la conciliaci\u00f3n del operador de c\u00e1psula y eliminando toda la aplicaci\u00f3n. como anotaciones de seguridad de pod, pol\u00edticas de red, rango de los l\u00edmites y elementos de cuota de recursos. Un atacante podr\u00eda separar el espacio de nombres de un inquilino que proh\u00edbe iniciar pods privilegiados utilizando las etiquetas de seguridad del pod eliminando la referencia de propietario, eliminando las etiquetas de aplicaci\u00f3n y pudiendo iniciar contenedores privilegiados que podr\u00edan iniciar una escalada de privilegios gen\u00e9rica de Kubernetes. Se han lanzado parches para la versi\u00f3n 0.1.3. No hay workarounds disponibles."}], "id": "CVE-2022-46167", "lastModified": "2026-06-17T05:11:20.877", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-46167", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-23T15:46:12.013257Z", "version": "2.0.3"}}]}, "published": "2022-12-02T19:15:11.097", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/clastix/capsule/releases/tag/v0.1.3"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/clastix/capsule/releases/tag/v0.1.3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}