Vulnerability · Published Oct 26, 2026 · Assigned by kubernetes
CVE-2026-2270StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
Medium 5.9
In plain English
A medium-severity authorization bypass via user-controlled key in Kubernetes from Kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | kubernetes | 1.20.5+really1.20.2-1 | DEBIAN-CVE-2026-2270 |
| Debian:13 | kubernetes | 1.20.5+really1.20.2-1 | DEBIAN-CVE-2026-2270 |
| Debian:14 | kubernetes | 1.20.5+really1.20.2-1 | DEBIAN-CVE-2026-2270 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kubernetes | Kubernetes | v1.34.0 – through v1.34.11v1.35.0 – through v1.35.8v1.36.0 – through v1.36.4v1.37.0 – through v1.37.0 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N