CVE-2026-2270

CVE-2026-2270 · StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.

CVSS 5.9 · Media · EPSS 0,3% · Corrección disponible

Publicación

2026-10-26T22:30:02.445Z

Actualización

2026-10-26T23:10:06.624Z

Pila tecnológica: system · containers

Comprueba tu servidor →