Description
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.
Metrics
CVSS 3.1 5.9/10
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:NWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Kubernetes | Kubernetes | >= v1.34.0, <= v1.34.11; >= v1.35.0, <= v1.35.8; >= v1.36.0, <= v1.36.4; >= v1.37.0, <= v1.37.0 |
References
Timeline
- Published
- Oct 26, 2026
- Last modified
- Oct 29, 2026
- NVD status
- Awaiting Analysis