CVE-2026-2270

Name of the Vulnerable Software and Affected Versions Kubernetes (affected versions not specified)

Description A confused deputy attack in the kube-controller-manager allows a user with write permissions for StatefulSet and ControllerRevision objects within their own namespace to potentially create a pod in a different namespace. The attacker can specify the metadata and configuration of the created pod. To ensure the pod is not removed by the garbage collector, the attacker must correctly specify the OwnerReference, including the UID of an existing StatefulSet in the target namespace.

Recommendations Update the master nodes to a version that contains the fix for this issue. Restrict write permissions for StatefulSet and ControllerRevision objects to minimize the risk of exploitation.