Kubernetes patches StatefulSet flaw allowing cross-namespace pods

Kubernetes has disclosed CVE-2026-2270, a Medium-severity (5.9) confused-deputy flaw in the StatefulSet controller. A user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects can create a pod in another namespace and fully control that pod’s metadata and specification, including namespace selection.

The cross-namespace pod is deleted at once by the garbage collector unless the attacker can supply a valid StatefulSet owner reference that cites the UID of an existing StatefulSet in the victim namespace. The issue therefore matters most in multi-tenant clusters where those write permissions are granted more broadly than intended.

Affected kube-controller-manager releases are v1.34.11 and earlier, v1.35.8 and earlier, v1.36.4 and earlier, and v1.37.0. Fixed builds (v1.34.12, v1.35.9, v1.36.5, and v1.37.1) restore only the StatefulSet spec from ControllerRevisions. The vulnerability was reported by ImanOracle. Operators who cannot upgrade immediately should treat StatefulSet and ControllerRevision write access as sensitive.