{"id":"CVE-2026-2270","title":"StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation","summary":"A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerabi…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"Kubernetes","product":"Kubernetes","affected":["Kubernetes >= v1.34.0 <= v1.34.11","Kubernetes >= v1.35.0 <= v1.35.8","Kubernetes >= v1.36.0 <= v1.36.4","Kubernetes >= v1.37.0 <= v1.37.0"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T23:10:06.624Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-2270","references":[{"url":"https://github.com/kubernetes/kubernetes/issues/142097"},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/wv0iV-Rcmj4"}],"tags":["cve.org"],"epss":0.00338,"epssPercentile":0.27027,"ingestedAt":"2026-10-27T16:11:59.153Z","slug":"CVE-2026-2270","body":"## Overview\n\nA confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.\n\n## Affected\n\n- `Kubernetes >= v1.34.0 <= v1.34.11`\n- `Kubernetes >= v1.35.0 <= v1.35.8`\n- `Kubernetes >= v1.36.0 <= v1.36.4`\n- `Kubernetes >= v1.37.0 <= v1.37.0`\n\n## Remediation\n\nTo mitigate this vulnerability, upgrade Kubernetes: https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}