CVE-2026-2270

CVE-2026-2270 · StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.

CVSS 5.9 · Mittel · EPSS 0,3% · Korrektur verfügbar

Veröffentlicht

2026-10-26T22:30:02.445Z

Aktualisiert

2026-10-29T10:45:47.863Z

Technologie-Stack: system · containers

Prüfen Sie Ihren Server →