# CVE-2026-2270: Kubernetes StatefulSet controller confused deputy in cross-namespace pod creation

Source: https://junglewise.ai/threats/cve-2026-2270-a-confused-deputy-attack-exists-in-the-statefulset-controller-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-2270 · Severity: medium · CVSS 5.9 · Published 2026-10-26

Kubernetes' StatefulSet controller contains a privilege escalation flaw that allows users with namespace-scoped permissions on StatefulSet and ControllerRevision objects to create pods in other namespaces. An attacker exploiting this can gain control over pod specification and metadata across namespaces, potentially leading to unauthorized access or lateral movement within a cluster.

Vendors: [Kubernetes](https://junglewise.ai/threats/vendors/kubernetes).

## Quick answers

**Is CVE-2026-2270 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2270 being exploited in the wild.

**How severe is CVE-2026-2270?** Medium severity, with a CVSS score of 5.9, published 26 October 2026.

**Which products and versions are affected?** Kubernetes Kube-Controller-Manager v1.34.11 and earlier, v1.35.8 and earlier, v1.36.4 and earlier, v1.37.0.

**Is there a fix for CVE-2026-2270?** Yes: fixed in kube-controller-manager v1.34.12 and later, v1.35.9 and later, v1.36.5 and later, v1.37.1 and later. Until then: Upgrade to a patched kube-controller-manager version; the fix ensures that only the spec field in StatefulSets is restored from ControllerRevisions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2270 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-2270?** Check whether you run Kubernetes Kube-Controller-Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in kube-controller-manager v1.34.12 and later, v1.35.9 and later, v1.36.5 and later, v1.37.1 and later

Upgrade to a patched kube-controller-manager version; the fix ensures that only the spec field in StatefulSets is restored from ControllerRevisions.

## Technical details

A confused deputy attack in the StatefulSet controller allows an attacker with namespace-scoped write access to StatefulSet and ControllerRevision objects to create cross-namespace pods by referencing a valid StatefulSet OwnerReference. The vulnerability stems from improper field restoration from ControllerRevisions, permitting manipulation of pod namespace selection. The flaw requires the attacker to reference an existing StatefulSet UID in the victim's namespace to prevent immediate garbage collection.

## Affected products

- Kubernetes kube-controller-manager v1.34.11 and earlier, v1.35.8 and earlier, v1.36.4 and earlier, v1.37.0

## Timeline

- 2026-09-14: disclosed
- 2026-10-26: advisory

## References

- [https://github.com/kubernetes/kubernetes/issues/142097](https://github.com/kubernetes/kubernetes/issues/142097)
- [https://groups.google.com/g/kubernetes-security-announce/c/wv0iV-Rcmj4](https://groups.google.com/g/kubernetes-security-announce/c/wv0iV-Rcmj4)