OESA-2026-4835: kubernetes security update
Container cluster management. Security Fix(es):
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace.(CVE-2026-2270)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/kubernetesto a version that resolves this vulnerability.Fixed in 1.20.2-35.oe2203sp4
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Clusters are exposed where a user has namespace-scoped write permissions for both StatefulSet and ControllerRevision objects. Exploitation also depends on the attacker being able to reference the UID of an existing StatefulSet in the target namespace.
What does an attacker need to do to make the cross-namespace pod persist?
The attacker must construct a valid StatefulSet OwnerReference using the UID of an existing StatefulSet in the victim namespace. Without a valid OwnerReference, the garbage collector immediately deletes the cross-namespace pod.
What access does the attacker gain over a created pod?
The attacker has full control over the resulting pod's metadata and specification, including its namespace selection. The issue does not require user interaction, but it requires high privileges as reflected by the need for write access to StatefulSet and ControllerRevision objects.