Read the docs
TI-2026-37292 Aliases CVE-2026-50570GHSA-qf5v-m7p4-95rp

Improper privilege management in fission

Priority LOW 37CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs (ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer), but the capability check was implemented as a fixed denylist of six Linux capabilities (SYS_ADMIN, NET_ADMIN, SYS_PTRACE, SYS_MODULE, DAC_READ_SEARCH, DAC_OVERRIDE). The denylist omitted CAP_SYS_TIME, among others. As a result, a tenant who could create a Function or Environment CRD could request securityContext.capabilities.add: ["SYS_TIME"], pass Fission's admission validation and merge-layer sanitization, and run attacker-controlled code with CAP_SYS_TIME in the resulting function or runtime container. This issue has been patched in version 1.25.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00274 19th percentileScored 2026-11-07
Fix Fixed fission (fission): 1.25.0github.com/fission/fission (Go): 1.25.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fissionfissionbefore 1.25.01.25.0Patch availableCNA
—github.com/fission/fission (Go)before 1.25.01.25.0Patch availableGHSA-qf5v-m7p4-95rp
  • fission Vendorfission Affected before 1.25.0 Fixed in 1.25.0 Patch available CNA
  • github.com/fission/fission (Go) Vendor— Affected before 1.25.0 Fixed in 1.25.0 Patch available GHSA-qf5v-m7p4-95rp

Remediation

  • Fix · CNA fission (fission) Fixed in 1.25.0
  • Fix · GHSA-qf5v-m7p4-95rp github.com/fission/fission (Go) Fixed in 1.25.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50570
  2. 2026-10-03 Alias added: GHSA-qf5v-m7p4-95rp

References

Advisory 1

Other 5

  • TI-2026-34271 Improper access control in fission CVSS 3.1CRITICAL 9.8
  • TI-2026-34273 Improper privilege management in fission CVSS 4.0HIGH 8.7
  • TI-2026-37288 Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation CVSS 3.1CRITICAL 9.9
  • TI-2026-37286 Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape CVSS 3.1CRITICAL 9.9
  • TI-2026-37285 Fission Container Executor Function PodSpec Injection Leading to Node Escape CVSS 3.1CRITICAL 9.9
  • TI-2026-37268 Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover CVSS 3.1CRITICAL 9.9
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences