OESA-2026-4833: kubernetes security update
Container cluster management. Security Fix(es):
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.(CVE-2026-2270)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/kubernetesto a version that resolves this vulnerability.Fixed in 1.29.1-21.oe2403sp3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs namespace-scoped write permissions for both StatefulSet and ControllerRevision objects. The issue is therefore relevant where a user or workload has those permissions in a namespace.
What must an attacker do to keep the cross-namespace pod from being removed?
The attacker must construct a valid StatefulSet OwnerReference that references the UID of an existing StatefulSet in the victim namespace. Without this, the garbage collector immediately deletes the created cross-namespace pod.
What control does a successful attacker have over the created pod?
The attacker has full control over the resulting pod's metadata and specification, including selecting its namespace.