Confused Deputy Attack in Kubernetes StatefulSet Controller Affects Users

CVE-2026-2270

What is CVE-2026-2270?

A security vulnerability has been identified in the StatefulSet controller of Kubernetes, which enables a confused deputy attack. This attack permits unauthorized users with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create cross-namespace pods. If exploited, an attacker can gain complete control over the metadata and specification of the pod, including its namespace selection. However, these cross-namespace pods are typically deleted by the garbage collector unless the attacker can successfully construct a valid StatefulSet OwnerReference, which involves referencing the UID of an existing StatefulSet in a targeted namespace. This poses significant risks to the security and integrity of Kubernetes deployments.

References