In plain words
Imagine you have a key to a specific door in a building, but because of a problem with the lock, you can use that key to open doors to other rooms you should not have access to. This Kubernetes bug is similar, where someone with permission to do things in one area can use that permission to create a new 'room' or 'pod' in another area they should not be able to access.
What's broken
The bug is in the StatefulSet¹ controller and involves ControllerRevision² objects. It allows an attacker with write permissions in one namespace to create a pod in another namespace. This means the attacker can control what the pod does and where it is created, which is a significant security issue. The CVE id for this bug is CVE-2026-2270³.
How it actually works
Here's how it works: normally, permissions in Kubernetes are set up to keep different namespaces separate. But because of this bug, an attacker who has write permissions on StatefulSet and ControllerRevision objects in one namespace can trick the system into creating a pod in a different namespace. This happens because the StatefulSet controller does not properly check the permissions when creating the pod, allowing the attacker to specify any namespace they want. This is an example of a confused deputy attack⁴, where a trusted component is tricked into doing something it should not do.
Proof of concept
There is a public discussion about this vulnerability, and it is not clear from the source if there is a specific proof-of-concept⁵ or exploit code available. A proof-of-concept would demonstrate that the vulnerability is real and can be exploited, which would increase the urgency for users to patch or mitigate the issue.
Is it real
It is not stated in the source if this vulnerability is being actively exploited in the wild. However, the fact that it allows for cross-namespace pod creation means it could be used by attackers to gain access to areas of the system they should not be able to reach. Limiting factors might include the need for specific permissions and the immediate deletion of the cross-namespace pod by the system, though this does not prevent the attack from happening in the first place.
What to do
To fix this issue, users should apply the appropriate patch or update for their Kubernetes version as soon as it becomes available. This will prevent attackers from exploiting the vulnerability to create pods in unauthorized namespaces.
Terms
- ¹ StatefulSet
- , A way to manage stateful applications in Kubernetes
- ² ControllerRevision
- , An object that stores revisions of a Kubernetes resource
- ³ CVE-2026-2270
- , A unique identifier for a security vulnerability
- ⁴ confused deputy attack
- , A type of attack where a trusted component is tricked into doing something it should not do
- ⁵ proof-of-concept
- , A demonstration that a security vulnerability is real and can be exploited