CVE-2026-50564 | Fission is an open-source, Kubernetes-native serverless fram… | CVSS 9.9 CRITICAL

Description

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Environment CRD exposes spec.runtime.podSpec and spec.builder.podSpec, which are merged into the Kubernetes pod specs for runtime and builder pods. The merge logic propagated hostNetwork, hostPID, hostIPC, container privileged, and serviceAccountName from the user-supplied podspec with no filtering, and Environment.Validate performed no security-relevant checks on these fields. This issue has been patched in version 1.24.0.

Metadata

CVE ID: CVE-2026-50564
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-04 21:34 UTC
Published: 2026-06-10 17:27 UTC
Last updated: 2026-06-12 03:55 UTC
Primary CWE: CWE-269
CWE-269: Improper Privilege Management
Vendor / Product: fission / fission
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
fission	fission	—	< 1.24.0

Weakness (CWE)

CWE	Source	Description
CWE-269	cna	CWE-269: Improper Privilege Management
CWE-284	cna	CWE-284: Improper Access Control
CWE-693	cna	CWE-693: Protection Mechanism Failure

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (3)

https://github.com/fission/fission/security/advisories/GHSA-gx55-f84r-v3r7 https://github.com/fission/fission/security/advisories/GHSA-gx55-f84r-v3r7
https://github.com/fission/fission/pull/3391 https://github.com/fission/fission/pull/3391
https://github.com/fission/fission/releases/tag/v1.24.0 https://github.com/fission/fission/releases/tag/v1.24.0