CVE-2026-2270 StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation

What is CVE-2026-2270?

CVE-2026-2270 is a medium-severity vulnerability in Kubernetes, published on 26 Oct 2026.

Official description

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.

Weakness: CWE-639

Which versions are affected by CVE-2026-2270?

How do I fix CVE-2026-2270?

Upgrade to a fixed version.

Is CVE-2026-2270 being exploited?

There is no known exploitation of CVE-2026-2270 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-111140, DEBIAN-CVE-2026-2270, GHSA-3jhc-p65m-8464.