Threats tagged 'ghsa-3jhc-p65m-8464'

CVE-2026-2270 is a medium severity vulnerability in the StatefulSet controller that enables a confused deputy attack. A user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects can create a pod in a different namespace. The attacker gains full control over the pod's metadata and specification, including the namespace. However, the cross-namespace pod is deleted by the garbage collector unless the attacker can reference a valid StatefulSet OwnerReference in the victim namespace.