CVE-2026-50567
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Fission is a Kubernetes-native serverless framework that prior to version 1.25.0 had a vulnerability in the Unarchive function, allowing attackers to write files to unauthorized locations. By manipulating archive names, an attacker could save files in other users' directories or in secret/config volumes.
Risk Assessment
This vulnerability poses a serious security risk as it allows attackers to access data and files within the system, potentially leading to breaches of confidentiality and data integrity in a multi-tenant environment.
Recommendation
It is recommended to upgrade to version 1.25.0 or later to mitigate this vulnerability and to conduct an audit of existing archives and configurations to minimize risk.
Other vulnerabilities in Fission
See all- CVE-2026-50545Critical
Fission is a serverless framework, native to Kubernetes, that simplifies the deployment of functions and applications. Prior to version 1.24.0, the lack of validation in Environment.spec.runtime.podSpec / spec.builder.podSpec led to the propagation of dangerous fields into generated pods.
- CVE-2026-50570High
Fission is a serverless framework, native to Kubernetes, which prior to version 1.25.0 had a vulnerability in PodSpec safety validation for Environment and Function CRDs. This vulnerability allowed the addition of the unauthorized capability CAP_SYS_TIME, enabling the execution of attacker-controlled code.
- CVE-2026-50569Medium
Fission is a serverless framework, native to Kubernetes, that prior to version 1.25.0 improperly validated the RelativeURL and Prefix fields in HTTPTriggerSpec.Validate(). These fields were only validated at the CLI level, allowing URL checks to be bypassed using kubectl or direct Kubernetes REST API calls.
- CVE-2026-50565Medium
Fission, a Kubernetes-native serverless framework, prior to version 1.24.0, created builder pods with auto-mounted service account tokens, potentially leading to unauthorized access to resources. This issue has been patched in version 1.24.0.
- CVE-2026-49822High
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications. Prior to version 1.24.0, a low-privilege developer could create a KubernetesWatchTrigger (KWT) in their own namespace, allowing for a persistent surveillance channel over any other namespace.
- CVE-2026-49821High
Fission is a serverless framework, native to Kubernetes, that simplifies the deployment of functions and applications. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that the namespace in Package.spec.environment matched the namespace in Package.metadata.
- CVE-2026-46618Medium
Fission is a serverless framework, Kubernetes-native, that prior to version 1.23.0 had a security vulnerability. In pkg/builder/builder.go, the Environment.spec.builder.command was passed without validation, allowing arbitrary code execution in the builder pod context.
Original NVD description (English source)
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/evil therefore landed at /tmp/evil. An attacker who could control a Package.Spec.Source.URL or Deployment.URL archive could induce the fetcher (running as the per-environment pod's fission-fetcher sidecar) to write files anywhere that process could reach: into other tenants' /packages/<ns>/ directories, into mounted secret/config volumes, or into the fetcher's own binary. This issue has been patched in version 1.25.0.