9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50563

CVE-2026-50563: Fission Container Executor Function PodSpec Injection Leading to Node Escape

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Container Executor path lets a tenant supply Function.spec.podspec directly; the executor merges it into the executor-built podspec and creates a Deployment whose pods run the user's container image. This issue has been patched in version 1.24.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50563

CVE-2026-50563:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/fission/fission	go	<= 1.23.0	1.24.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from insufficient validation of user-provided pod specifications in Fission, a serverless framework for Kubernetes. The core issue is a two-part flaw. First, at the admission control level, the FunctionSpec.Validate and Environment.Validate functions failed to inspect the contents of the podspec field. This allowed a user with permissions to create or update a Fission Function or Environment to supply a crafted podspec containing dangerous, privilege-escalating fields such as hostNetwork, hostPID, privileged: true, or hostPath volumes. Second, the MergePodSpec function in the executor, which is responsible for creating the final pod, unconditionally merged these dangerous fields from the user's spec into the final pod spec. This combination meant that a low-privilege user could trick Fission's high-privilege executor component into creating a pod with root-level access to the underlying Kubernetes node, resulting in a complete cluster compromise. The patch addresses this by adding strict validation in ValidatePodSpecSafety to reject these fields at admission time and, as a defense-in-depth measure, stripping them out in the MergePodSpec function to prevent exploitation even if the admission webhook were to fail or be bypassed.

Vulnerable functions

FunctionSpec.Validate

pkg/apis/core/v1/validation.go

This function was responsible for validating a function's specification before it was created. The vulnerability existed because this function did not inspect the contents of `spec.PodSpec` when the executor type was `container`. This allowed a user to provide a malicious pod specification with elevated privileges (e.g., host access, privileged containers), which the system would then use to create a pod, leading to a node escape. The patch adds a call to the new `ValidatePodSpecSafety` function to properly validate these fields.

MergePodSpec

pkg/executor/util/merge.go

This function merges a user-provided pod specification (`targetPodSpec`) with a system-generated one (`srcPodSpec`). The vulnerability lay in the fact that it unconditionally propagated dangerous fields like `HostNetwork`, `HostPID`, `HostIPC`, `ServiceAccountName`, and `hostPath` volumes from the user-supplied spec. This meant that even if validation was bypassed, the executor would still create a privileged pod on the user's behalf. The patch removes this direct propagation and adds sanitization logic to strip these fields, acting as a defense-in-depth mechanism.

Environment.Validate

pkg/apis/core/v1/validation.go

Similar to `FunctionSpec.Validate`, this function validates an `Environment` object. It was vulnerable because it failed to validate the pod specifications for the environment's runtime and builder (`e.Spec.Runtime.PodSpec` and `e.Spec.Builder.PodSpec`). This allowed a user with permissions to create or update environments to inject a malicious pod specification, which would then be used for all functions running in that environment, leading to privilege escalation. The patch adds calls to `ValidatePodSpecSafety` to secure this path.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.