A confused deputy attack exists in the StatefulSet controller that allows a user with namespace...
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes |
v1.34.0 – v1.34.11 v1.35.0 – v1.35.8 v1.36.0 – v1.36.4 v1.37.0 – v1.37.0 |
— — — — |
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-2270 kubernetes Fixed in: 1.20.5+really1.20.2-1
Original description The description as published by the source.
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web jordan@liggitt.net
- web jordan@liggitt.net
- web openwall.com
- web nvd.nist.gov
- web github.com