Security2 hSeptember 30, 2026, 23:09

Kubernetes fixes CVE-2026-2270: StatefulSet controller could create pods in other namespaces

On September 23 Kubernetes shipped patches for CVE-2026-2270, a confused deputy bug in the StatefulSet controller. A user with write access to StatefulSets and ControllerRevisions in one namespace could make the cluster create a pod in another namespace. The fix restores only the spec field from ControllerRevisions.

DEV Community

Open source

Patched versions released September 23: v1.34.12, v1.35.9, v1.36.5 and v1.37.1
The vulnerability has a CVSS score of 5.9 (medium)
Keeping the pod alive required the UID of a real StatefulSet in the victim namespace
No confirmed exploitation has been reported

#Kubernetes

CVE-2026-76822 in OpenCTI: readers can create cases

Software

Kubernetes 1.37 ships kyaml output to fix a YAML bug that deletes data

Security

Apache Tomcat 11.0.26 fixes HTTP/2 header mix-up regression CVE-2026-86350

Policy

Kubernetes fixes CVE-2026-2270: StatefulSet controller could create pods in other namespaces

CVE-2026-76822 in OpenCTI: readers can create cases

Kubernetes 1.37 ships kyaml output to fix a YAML bug that deletes data

Apache Tomcat 11.0.26 fixes HTTP/2 header mix-up regression CVE-2026-86350

Space Force Creates New Office to Fix Gap in Its Own Acquisition Reform