[kubernetes] CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A Kubernetes StatefulSet flaw lets namespace-scoped writers create a pod in another namespace.
48
CVE-2026-2270
Confused deputy in Kubernetes StatefulSet controller creates cross-namespace pods
- CVSS 3.1
- 5.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A confused deputy flaw in the Kubernetes StatefulSet controller lets a user who already has namespace-scoped write access to StatefulSet and ControllerRevision objects create a pod in another namespace. The attacker fully controls that pod’s metadata and spec, including which namespace it lands in. The garbage collector deletes the pod immediately unless the attacker supplies a valid OwnerReference using the UID of an existing StatefulSet in the victim namespace.
What to do: No fixed version is stated. Limit who can write StatefulSet and ControllerRevision objects so they cannot forge a cross-namespace OwnerReference.
| Product | Affected |
|---|---|
| Kubernetes StatefulSet controller | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
- Weakness
- CWE-639
- Vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N