[kubernetes] CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A Kubernetes StatefulSet flaw lets namespace-scoped writers create a pod in another namespace.
CVE-2026-2270 is a confused-deputy flaw in the Kubernetes StatefulSet controller. A user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects can cause creation of a pod in another namespace. The attacker has full control of the pod's metadata and specification, including the target namespace. The disclosure notes the cross-namespace pod is immediately deleted and does not report in-the-wild exploitation.
- Namespace write access to StatefulSet and ControllerRevision is required.
- The StatefulSet controller can be tricked into a cross-namespace pod.
- The attacker controls that pod's metadata and full specification.
- The resulting cross-namespace pod is immediately deleted.
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-2270 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Nathan Herz on Sep 23 Hello Kubernetes Community, A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the...
This source does not provide full text. Read it at seclists.org.