24 matches found
EUVD-2026-110501
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...
CVE-2026-2270
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...
DEBIAN-CVE-2026-2270
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...
AZL-111140 CVE-2026-2270 affecting package kubernetes 1.30.10-32
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...
CVE-2026-2270
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...
CVE-2026-2270 StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...
CVE-2026-2270
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...
CVE-2026-2270
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...
CVE-2026-2270 StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...
CVE-2026-2270 StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...
CVE-2026-2270
A confused deputy attack exists in the Kubernetes kube-controller-manager (specifically the StatefulSet controller). It allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a pod in a different namespace. Because the controller restores dat...
Kubernetes authorization issue vulnerability
Vulnerabilities related to authorization issues exist in Kubernetes versions from 1.34.0 through 1.34.11, from 1.35.0 through 1.35.8, from 1.36.0 through 1.36.4, and in version 1.37.0 and earlier. These vulnerabilities stem from confusion attacks on the StatefulSet controller. Users possessing...
CVE-2026-2270
A flaw was found in Kubernetes kube-controller-manager. The StatefulSet controller restores ControllerRevision data onto the whole StatefulSet object, including metadata. A user with namespace-scoped write access to StatefulSet and ControllerRevision can cause the controller to create a pod in...
SUSE CVE-2026-2270
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod's metada...
PT-2026-97726
Name of the Vulnerable Software and Affected Versions Kubernetes affected versions not specified Description A confused deputy attack in the kube-controller-manager allows a user with write permissions for StatefulSet and ControllerRevision objects within their own namespace to potentially create...
StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Medium 5.9 A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting thi...
EUVD-2023-53956
Malicious code in bioql PyPI...
CVE-2023-4066
A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker...
CVE-2023-4066 Operator: passwords defined in secrets shown in statefulset yaml
A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker...
CVE-2023-4066 Operator: passwords defined in secrets shown in statefulset yaml
A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker...