DEBIAN-CVE-2026-2270: Medium severity debian/kubernetes vulnerability

Q: Who can realistically exploit this issue?

An attacker needs namespace-scoped write permissions for both StatefulSet and ControllerRevision objects. The impact is most relevant where such permissions are granted to users or workloads that should not be able to create pods in other namespaces.

Q: What is required to keep the cross-namespace pod from being removed?

The attacker must construct a valid StatefulSet OwnerReference pointing to an existing StatefulSet in the victim namespace. This requires knowing and referencing that StatefulSet's UID; otherwise, the garbage collector immediately deletes the pod.

Q: What access does a successful attacker gain over the created pod?

They have full control of the resulting pod's metadata and specification, including its namespace selection. The vulnerability therefore enables creation of a pod in a namespace outside the attacker's authorized scope.

Published Oct 26, 2026

Updated

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.

Affected Software

3 affected componentsFixes available

debian/kubernetes<1.20.5+really1.20.2-1

1.20.5+really1.20.2-1

debian/kubernetes<1.20.5+really1.20.2-1

1.20.5+really1.20.2-1

debian/kubernetes<1.20.5+really1.20.2-1

1.20.5+really1.20.2-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/kubernetes to a version that resolves this vulnerability.
Fixed in 1.20.5+really1.20.2-1

Event History

Oct 26, 2026

CVE Published

via OSV·11:17 PM

Data Sourced

via OSV·11:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can realistically exploit this issue?

An attacker needs namespace-scoped write permissions for both StatefulSet and ControllerRevision objects. The impact is most relevant where such permissions are granted to users or workloads that should not be able to create pods in other namespaces.

What is required to keep the cross-namespace pod from being removed?

The attacker must construct a valid StatefulSet OwnerReference pointing to an existing StatefulSet in the victim namespace. This requires knowing and referencing that StatefulSet's UID; otherwise, the garbage collector immediately deletes the pod.

What access does a successful attacker gain over the created pod?

They have full control of the resulting pod's metadata and specification, including its namespace selection. The vulnerability therefore enables creation of a pod in a namespace outside the attacker's authorized scope.

DEBIAN-CVE-2026-2270: Medium severity debian/kubernetes vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can realistically exploit this issue?

What is required to keep the cross-namespace pod from being removed?

What access does a successful attacker gain over the created pod?

Company

Resources

Contact

Frequently Asked Questions

Who can realistically exploit this issue?

What is required to keep the cross-namespace pod from being removed?

What access does a successful attacker gain over the created pod?