An administrative error in Kubernetes' StatefulSet controller creates a confused deputy flaw that permits a user with namespace‑scoped write permissions on StatefulSet and ControllerRevision objects to fabricate a new pod that resides in a different namespace. Because the attacker can fully specify the pod's metadata and container specification, full control over the created pod is achievable. The pod will normally be removed by the garbage collector unless the attacker supplies a valid OwnerReference to an existing StatefulSet in the target namespace by referencing its UID; when that reference is provided, the pod can persist and execute arbitrary workloads. The flaw is an inappropriate access control violation (CWE‑1220) combined with an improper use of authority (CWE‑639).

The vulnerability affects the Kubernetes kube‑controller‑manager component in any cluster that uses StatefulSets and does not enforce restrictive RBAC. No specific version range is provided, so all deployed instances are potentially impacted until a vendor patch becomes available.

The vulnerability carries a CVSS score of 5.9, indicating medium risk. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the low privilege requirement – any user with write access to StatefulSet and ControllerRevision – lowers the attack bar. The vulnerability is not listed in the CISA KEV catalog. Exploitation would enable an internal actor to create pods in unauthorized namespaces, posing a significant risk particularly in clusters with permissive RBAC settings.