A confused deputy attack exists in the Kubernetes StatefulSet controller (kube-controller-manager) that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. ApplyRevision restored the whole StatefulSet object, including metadata such as the namespace, from attacker-controlled ControllerRevision data instead of only the spec. An attacker exploiting this vulnerability would have full control over the resulting pod's metadata and specification, including namespace selection. Affected: kube-controller-manager <= v1.34.11, <= v1.35.8, <= v1.36.4, = v1.37.0. Fixed in v1.34.12, v1.35.9, v1.36.5, v1.37.1.