CVE-2026-50570 Details
Description
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs (ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer), but the capability check was implemented as a fixed denylist of six Linux capabilities (SYS_ADMIN, NET_ADMIN, SYS_PTRACE, SYS_MODULE, DAC_READ_SEARCH, DAC_OVERRIDE). The denylist omitted CAP_SYS_TIME, among others. As a result, a tenant who could create a Function or Environment CRD could request securityContext.capabilities.add: ["SYS_TIME"], pass Fission's admission validation and merge-layer sanitization, and run attacker-controlled code with CAP_SYS_TIME in the resulting function or runtime container. This issue has been patched in version 1.25.0.
A vulnerability in Fission, a Kubernetes-native serverless framework, exists in versions prior to 1.25.0. The issue arises from an incomplete capability denylist in the PodSpec safety validation for Environment and Function custom resource definitions (CRDs). The validation process, which includes an admission webhook and a merge layer sanitization, failed to properly restrict certain Linux capabilities. Specifically, the denylist omitted CAP_SYS_TIME, allowing tenants to inject this capability and execute code with elevated privileges in their function or runtime containers. This exploitation could lead to cross-tenant interference by manipulating the node's wall clock, disrupting time-sensitive operations for all workloads on the node.
Users can upgrade to Fission version 1.25.0, which addresses this vulnerability by replacing the denylist with a proper allowlist for capabilities, ensuring that only safe capabilities can be added. Instructions for upgrading can be found in the Fission release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/fission/fission/pull/3465 | [email protected] | Source CodeVendor |
| https://github.com/fission/fission/releases/tag/v1.25.0 | [email protected] | Release NotesVendor |
| https://github.com/fission/fission/security/advisories/GHSA-qf5v-m7p4-95rp | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Fission | <= 1.24.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |