{"id":"CVE-2026-2270","revision":"58602cd76ead4602bee8f840fdc6ca55","records":[{"revision":"58602cd76ead4602bee8f840fdc6ca55","observedAt":"2026-10-29T04:47:47.759+00:00","statement":{"source":"cve-program","id":"CVE-2026-2270","aliases":[],"title":"StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation","description":"A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.","state":0,"publishedAt":"2026-10-26T22:30:02.445+00:00","modifiedAt":"2026-10-29T03:56:56.976+00:00","affected":[{"ecosystem":"Vendor product","name":"Kubernetes","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Kubernetes\",\n                    \"product\": \"Kubernetes\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"v1.34.0\",\n                            \"lessThanOrEqual\": \"v1.34.11\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"v1.35.0\",\n                            \"lessThanOrEqual\": \"v1.35.8\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"v1.36.0\",\n                            \"lessThanOrEqual\": \"v1.36.4\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"v1.37.0\",\n                            \"lessThanOrEqual\": \"v1.37.0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","score":5.9,"severity":"MEDIUM"}],"references":["https://github.com/kubernetes/kubernetes/issues/142097","https://groups.google.com/g/kubernetes-security-announce/c/wv0iV-Rcmj4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-2270","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-2270","identifiers":["CVE-2026-2270"]},"retained":false,"historicalAffected":[]}],"coverage":[]}