CVE-2026-50569
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Fission is a serverless framework, native to Kubernetes, that prior to version 1.25.0 improperly validated the RelativeURL and Prefix fields in HTTPTriggerSpec.Validate(). These fields were only validated at the CLI level, allowing URL checks to be bypassed using kubectl or direct Kubernetes REST API calls.
Risk Assessment
Organizations may be exposed to attacks that exploit improper URL validation, potentially leading to unauthorized access to functions and applications running on Kubernetes.
Recommendation
It is recommended to upgrade to version 1.25.0 or later to ensure proper validation of all fields in HTTPTriggerSpec.
Other vulnerabilities in Fission
See all- CVE-2026-50545Critical
Fission is a serverless framework, native to Kubernetes, that simplifies the deployment of functions and applications. Prior to version 1.24.0, the lack of validation in Environment.spec.runtime.podSpec / spec.builder.podSpec led to the propagation of dangerous fields into generated pods.
- CVE-2026-50570High
Fission is a serverless framework, native to Kubernetes, which prior to version 1.25.0 had a vulnerability in PodSpec safety validation for Environment and Function CRDs. This vulnerability allowed the addition of the unauthorized capability CAP_SYS_TIME, enabling the execution of attacker-controlled code.
- CVE-2026-50567High
Fission is a Kubernetes-native serverless framework that prior to version 1.25.0 had a vulnerability in the Unarchive function, allowing attackers to write files to unauthorized locations. By manipulating archive names, an attacker could save files in other users' directories or in secret/config volumes.
- CVE-2026-50565Medium
Fission, a Kubernetes-native serverless framework, prior to version 1.24.0, created builder pods with auto-mounted service account tokens, potentially leading to unauthorized access to resources. This issue has been patched in version 1.24.0.
- CVE-2026-49822High
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications. Prior to version 1.24.0, a low-privilege developer could create a KubernetesWatchTrigger (KWT) in their own namespace, allowing for a persistent surveillance channel over any other namespace.
- CVE-2026-49821High
Fission is a serverless framework, native to Kubernetes, that simplifies the deployment of functions and applications. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that the namespace in Package.spec.environment matched the namespace in Package.metadata.
- CVE-2026-46618Medium
Fission is a serverless framework, Kubernetes-native, that prior to version 1.23.0 had a security vulnerability. In pkg/builder/builder.go, the Environment.spec.builder.command was passed without validation, allowing arbitrary code execution in the builder pod context.
Original NVD description (English source)
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, HTTPTriggerSpec.Validate() validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only (pkg/fission-cli/cmd/httptrigger/create.go:83). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via kubectl apply or a direct Kubernetes REST API call bypassed every URL-level check. This issue has been patched in version 1.25.0.