CVE-2026-50545 Details

A critical vulnerability exists in Fission, a Kubernetes-native serverless framework, in versions prior to 1.24.0. The issue arises from the Environment.spec.runtime.podSpec and spec.builder.podSpec passthrough, which lacked proper validation. This oversight allowed dangerous fields to be merged into generated pods, creating a pathway for exploitation. The vulnerability could be exploited by applying an Environment configuration followed by a patch that introduced harmful pod specification elements, such as host networking or privileged access. This would enable a pod to escape its namespace and potentially compromise the entire Kubernetes cluster.

Users can upgrade to Fission version 1.24.0, where this vulnerability has been addressed. Instructions for upgrading can be found in the Fission documentation.