CVE-2026-2270
StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
- Record
CVE-2026-2270- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
EUVDEUVD-2026-110501
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
- Record
EUVD-2026-110501- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3jhc-p65m-8464
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace...
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
- Record
GHSA-3jhc-p65m-8464- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
NVD
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
- Record
CVE-2026-2270- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
OSV
StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
- Record
CVE-2026-2270- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-2270
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
- Record
DEBIAN-CVE-2026-2270- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVOESA-2026-4833
kubernetes security update
Container cluster management.
Security Fix(es):
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.(CVE-2026-2270)
- Record
OESA-2026-4833- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-11
OSVOESA-2026-4834
kubernetes security update
Container cluster management.
Security Fix(es):
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.(CVE-2026-2270)
- Record
OESA-2026-4834- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-11
OSVOESA-2026-4835
kubernetes security update
Container cluster management.
Security Fix(es):
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.(CVE-2026-2270)
- Record
OESA-2026-4835- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-11
OSVOESA-2026-4836
kubernetes security update
Container cluster management.
Security Fix(es):
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.(CVE-2026-2270)
- Record
OESA-2026-4836- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-11
OSVAZL-111140No score
CVE-2026-2270 affecting package kubernetes 1.30.10-32
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
- Record
AZL-111140- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kubernetesAzure Linux:3 | through 1.30.10-32 | None known |
kubernetesDebian:12 | before 1.20.5+really1.20.2-1 | 1.20.5+really1.20.2-1 |
kubernetesDebian:13 | before 1.20.5+really1.20.2-1 | 1.20.5+really1.20.2-1 |
kubernetesDebian:14 | before 1.20.5+really1.20.2-1 | 1.20.5+really1.20.2-1 |
kubernetesopenEuler:24.03-LTS-SP3 | before 1.29.1-21.oe2403sp3 | 1.29.1-21.oe2403sp3 |
kubernetesopenEuler:24.03-LTS-SP4 | before 1.29.1-21.oe2403sp4 | 1.29.1-21.oe2403sp4 |
kubernetesopenEuler:22.03-LTS-SP4 | before 1.20.2-35.oe2203sp4 | 1.20.2-35.oe2203sp4 |
kubernetesopenEuler:24.03-LTS-SP1 | before 1.29.1-21.oe2403sp1 | 1.29.1-21.oe2403sp1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-2270 is a medium vulnerability (CVSS 5.9) in Kubernetes, published October 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in kubernetes 1.20.5+really1.20.2-1.
References
github.com/kubernetes/kubernetes/issues/142097
groups.google.com/g/kubernetes-security-announce/c/wv0iV-Rcmj4
openwall.com/lists/oss-security/2026/09/23/35
nvd.nist.gov/vuln/detail/CVE-2026-2270
Show 5 moreShow less
security-tracker.debian.org/tracker/CVE-2026-2270
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4833