A flaw was found in kubernetes. The StatefulSet controller in kube-controller-manager restores a StatefulSet from a ControllerRevision by strategic-merge-patching the revision data onto the live object and then using the entire restored object. Revision data is meant to carry only the spec template used for rollbacks. Because metadata is also applied, a ControllerRevision can inject a different namespace, UID, and other object metadata.

A user who can write StatefulSet and ControllerRevision objects in a namespace can therefore cause kube-controller-manager to create a pod in another namespace, with full control of that pod’s spec. The cross-namespace pod is removed by garbage collection unless the attacker sets a valid StatefulSet OwnerReference, which requires the UID of an existing StatefulSet in the target namespace.

Default OpenShift edit/admin roles can write StatefulSets but only read ControllerRevisions. Extra RBAC (or cluster-admin) is required.