[kubernetes] CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A Kubernetes StatefulSet flaw lets namespace-scoped writers create a pod in another namespace.
CVE-2026-2270 is a confused-deputy flaw in the Kubernetes StatefulSet controller. A user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects can cause creation of a pod in another namespace. The attacker has full control of the pod's metadata and specification, including the target namespace. The disclosure notes the cross-namespace pod is immediately deleted and does not report in-the-wild exploitation.
- Namespace write access to StatefulSet and ControllerRevision is required.
- The StatefulSet controller can be tricked into a cross-namespace pod.
- The attacker controls that pod's metadata and full specification.
- The resulting cross-namespace pod is immediately deleted.
- CVEs
- CVE-2026-2270
- Products
- Kubernetes
- Organizations
- Kubernetes
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-2270 | Confused deputy in Kubernetes StatefulSet controller creates cross-namespace pods | 5.9 | — |
From the original article
Posted by Nathan Herz on Sep 23 Hello Kubernetes Community, A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.