Back to overview

CVE-2026-50545

CRITICAL
9.9
CVSS 3.1
Description
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Environment.spec.runtime.podSpec / spec.builder.podSpec passthrough lacked validation, and MergePodSpec propagated dangerous fields into the generated pods. This issue has been patched in version 1.24.0.

Metadata

CVE ID
CVE-2026-50545
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-04 20:37 UTC
Published
2026-06-10 17:26 UTC
Last updated
2026-06-12 03:55 UTC
Primary CWE
CWE-269
CWE-269: Improper Privilege Management
Vendor / Product
fission / fission
Sources
cve.org  ·  NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
fission fission — < 1.24.0
Weakness (CWE)
CWESourceDescription
CWE-269 cna CWE-269: Improper Privilege Management
CWE-284 cna CWE-284: Improper Access Control
CWE-693 cna CWE-693: Protection Mechanism Failure
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.9 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References (4)
Back to overview