Kubernetes StatefulSet Controller Cross-Namespace Pod Creation via Confused Deputy

#!/usr/bin/env bash
# CVE-2026-2270 Checker
# Kubernetes StatefulSet cross-namespace pod creation (confused deputy)
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

echo "[*] CVE-2026-2270 Vulnerability Check"
echo "[*] Affected: kube-controller-manager <= 1.34.11, <= 1.35.8, <= 1.36.4, == 1.37.0"
echo ""

if ! command -v kubectl &>/dev/null; then
  echo "[!] kubectl not found in PATH"
  echo "UNKNOWN"
  exit 2
fi

# Get full server version
FULL_VER=$(kubectl version --output=json 2>/dev/null | \
  python3 -c "
import sys, json
try:
    v = json.load(sys.stdin).get('serverVersion', {})
    print(v.get('gitVersion', '').lstrip('v'))
except Exception:
    print('')
" 2>/dev/null) || true

if [[ -z "$FULL_VER" || "$FULL_VER" == "" ]]; then
  echo "[!] Could not determine Kubernetes server version."
  echo "[!] Ensure kubectl is configured and the cluster is reachable."
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected server version: v${FULL_VER}"

# Extract major, minor, patch
MAJOR=$(echo "$FULL_VER" | cut -d. -f1)
MINOR=$(echo "$FULL_VER" | cut -d. -f2 | tr -d '+')
PATCH=$(echo "$FULL_VER" | cut -d. -f3 | grep -oE '^[0-9]+' || echo "0")

if [[ -z "$MAJOR" || -z "$MINOR" || -z "$PATCH" ]]; then
  echo "[!] Could not parse version components from v${FULL_VER}"
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Parsed: major=${MAJOR} minor=${MINOR} patch=${PATCH}"

# Version is newer than all affected branches
if [[ "$MINOR" -ge 38 ]]; then
  echo "[+] v${FULL_VER} is newer than all affected branches."
  echo "PATCHED"
  exit 0
fi

# Version is older than tested range
if [[ "$MINOR" -lt 34 ]]; then
  echo "[?] v${FULL_VER} is older than the tested range (1.34+)."
  echo "[?] This version may be vulnerable but was not tested by the advisory."
  echo "UNKNOWN"
  exit 2
fi

# Check each supported branch
case "$MINOR" in
  34)
    if [[ "$PATCH" -ge 12 ]]; then
      echo "[+] PATCHED — v${FULL_VER} >= v1.34.12"
      echo "PATCHED"
      exit 0
    else
      echo "[-] VULNERABLE — v${FULL_VER} < v1.34.12"
      echo "VULNERABLE"
      exit 1
    fi
    ;;
  35)
    if [[ "$PATCH" -ge 9 ]]; then
      echo "[+] PATCHED — v${FULL_VER} >= v1.35.9"
      echo "PATCHED"
      exit 0
    else
      echo "[-] VULNERABLE — v${FULL_VER} < v1.35.9"
      echo "VULNERABLE"
      exit 1
    fi
    ;;
  36)
    if [[ "$PATCH" -ge 5 ]]; then
      echo "[+] PATCHED — v${FULL_VER} >= v1.36.5"
      echo "PATCHED"
      exit 0
    else
      echo "[-] VULNERABLE — v${FULL_VER} < v1.36.5"
      echo "VULNERABLE"
      exit 1
    fi
    ;;
  37)
    if [[ "$PATCH" -ge 1 ]]; then
      echo "[+] PATCHED — v${FULL_VER} >= v1.37.1"
      echo "PATCHED"
      exit 0
    else
      echo "[-] VULNERABLE — v1.37.0 is the only affected 1.37 release"
      echo "VULNERABLE"
      exit 1
    fi
    ;;
  *)
    echo "[?] Minor version 1.${MINOR} is not in the advisory's affected range."
    echo "UNKNOWN"
    exit 2
    ;;
esac