9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50564

CVE-2026-50564: Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Environment CRD exposes spec.runtime.podSpec and spec.builder.podSpec, which are merged into the Kubernetes pod specs for runtime and builder pods. The merge logic propagated hostNetwork, hostPID, hostIPC, container privileged, and serviceAccountName from the user-supplied podspec with no filtering, and Environment.Validate performed no security-relevant checks on these fields. This issue has been patched in version 1.24.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50564

CVE-2026-50564:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/fission/fission	go	<= 1.23.0	1.24.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allowed a user with permissions to create or update Fission Environment or Function resources to escalate their privileges and compromise a Kubernetes node. This was possible due to two main failures in the Fission platform:

Insufficient Admission Validation: The primary validation logic, found in (*v1.Environment).Validate and (v1.FunctionSpec).Validate, did not inspect the contents of user-provided pod specifications (podSpec). This allowed users to submit CRDs containing dangerous settings like hostNetwork: true, hostPID: true, privileged: true, or hostPath volumes. Furthermore, the validation webhook for Environments only triggered on CREATE operations, allowing an attacker to create a benign resource and then UPDATE it with a malicious podSpec to bypass checks.
Insecure PodSpec Merging: The util.MergePodSpec function, which is used by Fission's runtime and builder components, would then take the user's malicious podSpec and merge it into the final pod definition. The vulnerable version of this function blindly propagated the dangerous fields, directly causing the creation of a privileged pod with access to the host node's resources.

An attacker could exploit this to create a pod that shares the host's network, PID, and IPC namespaces, and has privileged container settings. From this position, they could gain root access to the node, access the container runtime socket, steal cloud credentials, and potentially take over the entire cluster. The patch remediates this by adding strict validation at the admission layer via a new ValidatePodSpecSafety function and implementing defense-in-depth by stripping out dangerous fields at the merge layer, ensuring that such settings are never propagated to the final pods.

Vulnerable functions

(*v1.Environment).Validate

pkg/apis/core/v1/validation.go

This function was responsible for validating the Environment CRD. Before the patch, it lacked any checks for dangerous fields within the `spec.runtime.podSpec` and `spec.builder.podSpec`. This allowed a user with permissions to create or update an Environment to specify privileged settings (like hostPID, hostNetwork) that would be used for function pods, leading to a node escape.

util.MergePodSpec

pkg/executor/util/merge.go

This function merges a user-provided pod specification (`targetPodSpec`) into a source specification. The vulnerable version of this function directly propagated dangerous fields like `HostNetwork`, `HostPID`, `HostIPC`, and `ServiceAccountName` without any validation or sanitization. This meant that even if validation was bypassed, the executor would still create a privileged pod based on the malicious user input.

(v1.FunctionSpec).Validate

pkg/apis/core/v1/validation.go

Similar to the Environment validation, this function was responsible for validating a Function's specification. It failed to check for dangerous fields in `spec.podSpec` when the function was configured to use the 'container' executor type. This provided another vector for a user to define a malicious pod specification and achieve privilege escalation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.