CVE-2026-2270

[CVE catalog]

Severity

Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Published

Sep 15, 2026, 4:00:00 PM UTC

Source

[NVD] · [CVE record]

A flaw was found in Kubernetes kube-controller-manager. The StatefulSet controller restores ControllerRevision data onto the whole StatefulSet object, including metadata. A user with namespace-scoped write access to StatefulSet and ControllerRevision can cause the controller to create a pod in another namespace. That pod is deleted by garbage collection unless the attacker can name the UID of a StatefulSet in the target namespace. kube-controller-manager: kube-controller-manager: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation The attacker needs write on both StatefulSet and ControllerRevision in some namespace, plus a way to make the controller apply that revision. Default OpenShift edit and admin roles do not grant ControllerRevision create/update (only get/list/watch), matching upstream Kubernetes. A custom Role or cluster-admin is required. For the pod to survive, the attacker must also know a StatefulSet UID in the victim namespace. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.