Bug 2526751 (CVE-2026-2270)

Summary:	CVE-2026-2270 kube-controller-manager: kube-controller-manager: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, anjoseph, aos-team-art-private, asdas, dpaolell, gparvin, jbalunas, jdelft, jprabhak, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhaigner, sakbas, security-response-team, sghai, sidsharm, suppawar, tsze, vlaad, wtam
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Kubernetes kube-controller-manager. The StatefulSet controller restores ControllerRevision data onto the whole StatefulSet object, including metadata. A user with namespace-scoped write access to StatefulSet and ControllerRevision can cause the controller to create a pod in another namespace. That pod is deleted by garbage collection unless the attacker can name the UID of a StatefulSet in the target namespace.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-09-15

Description OSIDB Bzimport 2026-09-01 12:30:30 UTC

A flaw was found in kubernetes. The StatefulSet controller in kube-controller-manager restores a StatefulSet from a ControllerRevision by strategic-merge-patching the revision data onto the live object and then using the entire restored object. Revision data is meant to carry only the spec template used for rollbacks. Because metadata is also applied, a ControllerRevision can inject a different namespace, UID, and other object metadata.

A user who can write StatefulSet and ControllerRevision objects in a namespace can therefore cause kube-controller-manager to create a pod in another namespace, with full control of that pod’s spec. The cross-namespace pod is removed by garbage collection unless the attacker sets a valid StatefulSet OwnerReference, which requires the UID of an existing StatefulSet in the target namespace.

Default OpenShift edit/admin roles can write StatefulSets but only read ControllerRevisions. Extra RBAC (or cluster-admin) is required.