---
id: CVE-2026-2270
title: >-
  StatefulSet and ControllerRevision write permissions allow cross-namespace pod
  creation
summary: >-
  A confused deputy attack exists in the StatefulSet controller that allows a
  user with namespace-scoped write permissions on StatefulSet and
  ControllerRevision objects to create a cross-namespace pod. An attacker
  exploiting this vulnerabi…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: Kubernetes
product: Kubernetes
affected:
  - Kubernetes >= v1.34.0 <= v1.34.11
  - Kubernetes >= v1.35.0 <= v1.35.8
  - Kubernetes >= v1.36.0 <= v1.36.4
  - Kubernetes >= v1.37.0 <= v1.37.0
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T23:10:06.624Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-2270'
references:
  - url: 'https://github.com/kubernetes/kubernetes/issues/142097'
  - url: 'https://groups.google.com/g/kubernetes-security-announce/c/wv0iV-Rcmj4'
tags:
  - cve.org
epss: 0.00338
epssPercentile: 0.27027
ingestedAt: '2026-10-27T16:11:59.153Z'
---

## Overview

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.

## Affected

- `Kubernetes >= v1.34.0 <= v1.34.11`
- `Kubernetes >= v1.35.0 <= v1.35.8`
- `Kubernetes >= v1.36.0 <= v1.36.4`
- `Kubernetes >= v1.37.0 <= v1.37.0`

## Remediation

To mitigate this vulnerability, upgrade Kubernetes: https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/