Bug 2571724

Summary: CVE-2026-2270 kubernetes1.35: kube-controller-manager: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation [fedora-all]
Product: [Fedora] Fedora Reporter: Isaiah Johnson <isjohnso>
Component: kubernetes1.35Assignee: Brad Smith <bradley.g.smith>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: bradley.g.smith, go-sig
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["9b2d4ad8-fc37-4ebb-b2b3-f48f6be54d7c"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2526751    

Description Isaiah Johnson 2026-11-11 14:21:31 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in kubernetes. The StatefulSet controller in kube-controller-manager restores a StatefulSet from a ControllerRevision by strategic-merge-patching the revision data onto the live object and then using the entire restored object. Revision data is meant to carry only the spec template used for rollbacks. Because metadata is also applied, a ControllerRevision can inject a different namespace, UID, and other object metadata.

A user who can write StatefulSet and ControllerRevision objects in a namespace can therefore cause kube-controller-manager to create a pod in another namespace, with full control of that pod’s spec. The cross-namespace pod is removed by garbage collection unless the attacker sets a valid StatefulSet OwnerReference, which requires the UID of an existing StatefulSet in the target namespace.

Default OpenShift edit/admin roles can write StatefulSets but only read ControllerRevisions. Extra RBAC (or cluster-admin) is required.