CVE-2026-50564

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.24.0

Description Fission is a Kubernetes-native serverless framework. The Environment CRD exposes spec.runtime.podSpec and spec.builder.podSpec, which are merged into the Kubernetes pod specs for runtime and builder pods. The merge logic allows the propagation of hostNetwork, hostPID, hostIPC, container privileged, and serviceAccountName from the user-supplied podspec without filtering. Additionally, the Environment.Validate() function performs no security-relevant checks on these fields, potentially enabling node escape through privileged pods.

Recommendations Update to version 1.24.0.