CVE-2026-50570

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.25.0

Description Fission is a Kubernetes-native serverless framework. An incomplete capability denylist in the PodSpec safety validation for tenant-facing Environment and Function Custom Resource Definitions (CRDs) allows the addition of unauthorized Linux capabilities. Specifically, the ValidatePodSpecSafety and ValidateContainerSafety admission webhooks, along with the sanitizeContainerSecurityContext executor merge layer, failed to include CAP SYS TIME in their restricted list. This allows a tenant with permissions to create a Function or Environment CRD to request securityContext.capabilities.add: ["SYS TIME"], bypassing validation to run code with CAP SYS TIME privileges in the function or runtime container, which can lead to cross-tenant node wall-clock corruption.

Recommendations Update to version 1.25.0.