{"schema":"threatline.record/2","record":{"id":"CVE-2026-2270","aliases":[],"summary":"StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation","details":"A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.","categories":["Containers & cloud"],"product":"Kubernetes","vendor":"Kubernetes","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-2270","source_modified_at":"2026-10-26T23:10:06.624Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"Kubernetes","vendor":"Kubernetes","versions":[{"status":"affected","version":"v1.34.0","lessThanOrEqual":"v1.34.11","versionType":"custom"},{"status":"affected","version":"v1.35.0","lessThanOrEqual":"v1.35.8","versionType":"custom"},{"status":"affected","version":"v1.36.0","lessThanOrEqual":"v1.36.4","versionType":"custom"},{"status":"affected","version":"v1.37.0","lessThanOrEqual":"v1.37.0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T22:30:02.445Z","modified_at":"2026-10-26T23:10:06.624Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-2270","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T23:10:06.624Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/kubernetes/kubernetes/issues/142097","tags":["issue-tracking"]},{"source":"CVE List","url":"https://groups.google.com/g/kubernetes-security-announce/c/wv0iV-Rcmj4","tags":["mailing-list"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-26T23:10:06.624Z","content_hash":"397686569d45dd1257dd0cff445be6cc4b4981c6e39bd46ee893d2433e18aa3d"}}