Cloudanix VulnDB

CVE-2026-2270

Medium · 5.9

CVSS

5.9

EPSS

0.3%

Published

Oct 26, 2026

CISA due date

—

The record

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities