A flaw exists in the Kubernetes kube-controller-manager whereby the StatefulSet controller restores ControllerRevision data, including metadata, onto the entire StatefulSet object. An attacker with namespace-scoped write access to StatefulSet and ControllerRevision can trick the controller into creating a pod that resides in a different namespace. The created pod is normally removed by garbage collection unless the attacker can present the UID of a StatefulSet in the target namespace, allowing the pod to persist. This reflects an inappropriate access control weakness (CWE-1220) that permits cross‑namespace pod creation and can be leveraged for privilege escalation or lateral movement.

The vulnerability affects the Kubernetes kube-controller-manager component in any cluster that uses StatefulSets and does not enforce restrictive RBAC. No specific version range is provided, so all deployed instances are potentially impacted until a vendor patch becomes available.

The vulnerability carries a CVSS score of 5.9, indicating medium risk. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the low privilege requirement – any user with write access to StatefulSet and ControllerRevision – lowers the attack bar. The vulnerability is not listed in the CISA KEV catalog. Exploitation would enable an internal actor to create pods in unauthorized namespaces, posing a significant risk particularly in clusters with permissive RBAC settings.