CVE-2026-50563 PUBLISHED

Fission Container Executor Function PodSpec Injection Leading to Node Escape

Assigner: GitHub_M
Reserved: 04.06.2026 Published: 10.06.2026 Updated: 11.06.2026

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Container Executor path lets a tenant supply Function.spec.podspec directly; the executor merges it into the executor-built podspec and creates a Deployment whose pods run the user's container image. This issue has been patched in version 1.24.0.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.9

Product Status

Vendor fission
Product fission
Versions
  • Version < 1.24.0 is affected

References

Problem Types

  • CWE-269: Improper Privilege Management CWE
  • CWE-284: Improper Access Control CWE