GHSA-7m8x-qg2j-4m3v: Fission MessageQueueTrigger Scaler Manager Materializes Secret Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7m8x-qg2j-4m3v",
  "modified" : "2026-06-30T18:12:48Z",
  "published" : "2026-06-30T18:12:48Z",
  "aliases" : [ ],
  "summary" : "Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec",
  "details" : "### Summary\n\nThe Fission MessageQueueTrigger (MQT) scaler controller exposed two privilege-escalation primitives to any subject able to create MQTs in a namespace.\n\n### Details\n\n**1. Secret materialization.** `getEnvVarlist` in `pkg/mqtrigger/scalermanager.go` read the Secret named in `Spec.Secret` using the controller's cluster-wide `secrets/get` RBAC and emitted each key as a literal `EnvVar.Value`, copying\nthe plaintext secret content into the connector Deployment's pod template. A subject holding `messagequeuetriggers/create` but **not** `secrets/get` could exfiltrate any Secret in the namespace by pointing an MQT at it.\n\n**2. PodSpec injection.** `Spec.PodSpec` was merged into the controller-built connector PodSpec via `util.MergePodSpec` with no allowlist on which fields could come from the user. An MQT could substitute `Containers[].Image` (run any\nimage), override `Command`/`Args`, inject `Env`, add `VolumeMounts` + `Volumes`, override `ServiceAccountName`, and set `HostNetwork`/`HostPID`/`HostIPC` — turning `messagequeuetriggers/create` into effective `deployments/create` with an\n arbitrary image and service account.\n\n### Impact\n\nA tenant with only `messagequeuetriggers.fission.io/create` in a namespace could read any Secret in that namespace and run an arbitrary container image under an arbitrary service account, escalating well beyond their intended RBAC.\n\n### Fix\n\nFixed in [#3367](https://github.com/fission/fission/pull/3367) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0).\n\n- `getEnvVarlist` now emits `EnvVar.ValueFrom.SecretKeyRef` so the connector pod resolves values at start time under its own service account. The secret values are never written into the Deployment object and never logged.\n- A new allowlist, `MergeAllowedPodSpecFields` (`pkg/executor/util/merge_allowlist.go`), accepts only `NodeSelector`, `Tolerations`, `Affinity`, `RuntimeClassName`, and per-container `Resources`. All other user-supplied fields are\ndropped at the controller layer, and the validating webhook rejects every populated non-allowlisted field with a clear error. The webhook and the merge helper share a single canonical `DisallowedPodSpecFields` enumeration so they cannot\ndrift.\n\n### Behavioural change\n\nMQT authors that previously overrode the connector image, command, args, env, volumes, service account, or host namespaces via `Spec.PodSpec` will see those fields rejected at admission (or silently dropped if the webhook is disabled).\nAllowlisted fields flow through unchanged.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/fission/fission"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.24.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.23.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/security/advisories/GHSA-7m8x-qg2j-4m3v"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/pull/3367"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/commit/94bf5792396989fdd71961e8701833c8110da889"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/fission/fission"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/releases/tag/v1.24.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200", "CWE-269", "CWE-284" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-30T18:12:48Z",
    "nvd_published_at" : null
  }
}