CVE-2026-2270

A flaw was found in Kubernetes kube-controller-manager. The StatefulSet controller restores ControllerRevision data onto the whole StatefulSet object, including metadata. A user with namespace-scoped write access to StatefulSet and ControllerRevision can cause the controller to create a pod in...

PT-2026-97726

Name of the Vulnerable Software and Affected Versions Kubernetes affected versions not specified Description A confused deputy attack in the kube-controller-manager allows a user with write permissions for StatefulSet and ControllerRevision objects within their own namespace to potentially create...

StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation

CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Medium 5.9 A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting thi...

CVE-2026-24176

NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespace pod references. A successful exploit of this vulnerability might lead to data tampering...

EUVD-2026-24145

NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespace pod references. A successful exploit of this vulnerability might lead to data tampering...

CVE-2026-24176

NVIDIA KAI Scheduler is affected by CVE-2026-24176, where improper authorization can occur via cross-namespace pod references, potentially enabling data tampering. Public sources (NVD/ENISA/PT-Security/NVIDIA bulletin) describe the vulnerability and assign CVSS v3.1 metrics: AV:N/AC:L/PR:L/UI:N/S...

CVE-2026-24176: Incorrect Authorization

NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespace pod references. A successful exploit of this vulnerability might lead to data tampering...

PT-2026-33998

NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespace pod references. A successful exploit of this vulnerability might lead to data tampering...