{"id":"CVE-2026-2270","aliases":[],"title":"StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation","titleSource":"kubernetes","descriptionSource":"kubernetes","products":[{"vendor":"Kubernetes","name":"Kubernetes","platforms":[],"versions":[{"version":"v1.34.0","status":"affected","lessThanOrEqual":"v1.34.11","versionType":"custom"},{"version":"v1.35.0","status":"affected","lessThanOrEqual":"v1.35.8","versionType":"custom"},{"version":"v1.36.0","status":"affected","lessThanOrEqual":"v1.36.4","versionType":"custom"},{"version":"v1.37.0","status":"affected","lessThanOrEqual":"v1.37.0","versionType":"custom"}],"defaultStatus":"unaffected","source":"kubernetes","url":"https://www.cve.org/CVERecord?id=CVE-2026-2270"}],"remediation":[{"text":"To mitigate this vulnerability, upgrade Kubernetes: https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/","source":"kubernetes","url":"https://www.cve.org/CVERecord?id=CVE-2026-2270"}],"description":"A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.","severity":"medium","score":5.9,"published":"2026-10-26T22:30:02.445Z","modified":"2026-10-26T23:10:06.624Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://github.com/kubernetes/kubernetes/issues/142097","https://groups.google.com/g/kubernetes-security-announce/c/wv0iV-Rcmj4"],"sources":[{"name":"CVE","id":"CVE-2026-2270","modified":"2026-10-26T23:10:06.624Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-2270"}],"assessments":[{"source":"kubernetes","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","score":5.9}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:00:30.919Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}