https://seclists.org/oss-sec/2026/q3/914: [kubernetes] CVE-2026-2270: StatefulSet and Controllervision write permissions allow cross-namespace pod cation

Q: Which permissions make an environment exposed to exploitation?

An attacker needs namespace-scoped write permissions for both StatefulSet and ControllerRevision objects. No user interaction is required.

Q: What must an attacker do to keep the cross-namespace pod from being deleted?

The attacker must create a valid StatefulSet OwnerReference that references the UID of an existing StatefulSet in the victim namespace. Without this, the garbage collector immediately deletes the pod.

Q: Which kube-controller-manager releases are affected?

Affected releases include kube-controller-manager versions up to v1.34.11, up to v1.35.8, up to v1.36.4, and v1.37.0.

Q: What should be done to mitigate the issue?

Upgrade kube-controller-manager to a fixed version. The patched versions ensure that only the spec field is processed as intended.

Published Sep 23, 2026

Updated

Affected Software

1 affected component

Kubernetes kube-controller-manager<=v1.34.11, <=v1.35.8, <=v1.36.4, =v1.37.0

Frequently Asked Questions

Which permissions make an environment exposed to exploitation?

An attacker needs namespace-scoped write permissions for both StatefulSet and ControllerRevision objects. No user interaction is required.

What must an attacker do to keep the cross-namespace pod from being deleted?

The attacker must create a valid StatefulSet OwnerReference that references the UID of an existing StatefulSet in the victim namespace. Without this, the garbage collector immediately deletes the pod.

Which kube-controller-manager releases are affected?

Affected releases include kube-controller-manager versions up to v1.34.11, up to v1.35.8, up to v1.36.4, and v1.37.0.

What should be done to mitigate the issue?

Upgrade kube-controller-manager to a fixed version. The patched versions ensure that only the spec field is processed as intended.