CVE-2026-2270 - StatefulSet and ControllerRevision Vulnerability
CVE-2026-2270 - StatefulSet and ControllerRevision Vulnerability
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. ⚠️
Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
Affected Products
The following products are affected by the CVE-2026-2270 vulnerability, specifically Kubernetes:
- ID: 1
- Vendor: Kubernetes
- Product: kubernetes
Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.
CVE Details
The CVE was newly received on October 26, 2026. The added description for CVE-2026-2270 specifies: “A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod.”
Further details from the history indicate: “Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.”
The vulnerability was assigned a CVSS V3.1 score of AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N and categorized under CWE-639.
References
For more information, you can check the following links:
To read the complete article see: Read full article