CVE-2026-50566 Details
Description
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a tenant with environments.fission.io create/update RBAC can run privileged / allowPrivilegeEscalation / dangerous-capability containers in the Fission function or builder namespace, scheduled under the executor's high-privilege service account — enabling container-sandbox escape, host filesystem and network access, and potential node- and cluster-level compromise. This issue has been patched in version 1.24.0.
A vulnerability in Fission prior to version 1.24.0 allows tenants with create/update RBAC to bypass security validations and run privileged containers in the Fission function or builder namespace. This exploitation occurs under the executor's high-privilege service account, leading to container-sandbox escape, access to the host filesystem and network, and potential compromise of the node and cluster. The vulnerability arises because the Environment CRD's container security context is not properly validated, allowing dangerous capabilities to be merged into pods without appropriate sanitization.
Users can upgrade to Fission version 1.24.0, where this vulnerability has been patched. Additionally, it is recommended to restrict Environment create/update RBAC to trusted administrators and deploy a policy using Kyverno or OPA Gatekeeper to reject dangerous Container SecurityContext settings on Environment CRDs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/fission/fission/pull/3406 | [email protected] | Source CodeVendor |
| https://github.com/fission/fission/releases/tag/v1.24.0 | [email protected] | Release NotesVendor |
| https://github.com/fission/fission/security/advisories/GHSA-m63v-2g9w-2w6v | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-250 | Execution with Unnecessary Privileges | [email protected] |
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Fission | <= 1.23.0 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |