CVE-2026-50563: Github.com/fission/fission Fission Container Executor Function PodSpec Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-v455-mv2v-5g92",
  "modified" : "2026-06-30T18:18:42Z",
  "published" : "2026-06-30T18:18:42Z",
  "aliases" : [ "CVE-2026-50563" ],
  "summary" : "Fission Container Executor Function PodSpec Injection Leading to Node Escape",
  "details" : "### Summary\n\nFission's Container Executor path lets a tenant supply `Function.spec.podspec` directly; the executor merges it into the executor-built podspec and creates a Deployment whose pods run the user's container image.\n\n### Details\n\nTwo flaws compounded:\n\n1. `pkg/apis/core/v1/validation.go::FunctionSpec.Validate` only checked that `spec.PodSpec != nil` when `executorType: container`; it did not inspect the content of `spec.PodSpec`.\n2. `pkg/executor/util/merge.go::MergePodSpec` unconditionally forwarded `hostPID`, `hostNetwork`, `hostIPC`, hostPath volumes, `serviceAccountName`, and container `privileged` into the Deployment spec via the container-executor sink\n(`pkg/executor/executortype/container/deployment.go::getDeploymentSpec`).\n\nA tenant with only `functions.fission.io/create` could deploy a Function with a crafted podspec that mounted the host root filesystem and shared host namespaces. The executor — running under its high-privilege SA, which holds\n`deployments/create` on the function namespace — created that Deployment on the tenant's behalf, turning Function-create into effective `deployments/create` with arbitrary pod-security configuration.\n\nThis is the Function-CRD sibling of GHSA-gx55-f84r-v3r7 / GHSA-wmgg-3p4h-48x7, with a **lower** attack threshold: regular function developers typically hold `functions/create` but not `environments/create`.\n\n### Impact\n\nA tenant with only `functions.fission.io/create` is escalated to node escape via a privileged, host-namespace pod scheduled by the executor.\n\n### Fix\n\nFixed in [#3391](https://github.com/fission/fission/pull/3391) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0).\n\n- `FunctionSpec.Validate` now calls `ValidatePodSpecSafety(\"Function.spec.podspec\", spec.PodSpec)` after the existing `spec.PodSpec == nil` check.\n- The Function validating webhook is already registered on `verbs=create;update`, so it picks up the new validation with no marker change.\n- The same merge-layer strip and per-container sanitize used for the Environment path applies here, since the container-executor sink calls `util.MergePodSpec`.\n\nSee GHSA-gx55-f84r-v3r7 for the detailed fix.\n\n### Behavioural change\n\nFunctions whose `spec.podspec` sets host namespaces, hostPath volumes, container `privileged`/`allowPrivilegeEscalation`, dangerous Linux capabilities, or a `serviceAccountName` override are now rejected at admission. Legitimate\ncontainer-executor functions that set `image`, `command`, `args`, `env`, `resources`, `nodeSelector`, `tolerations`, `affinity`, non-hostPath `volumes`, or `volumeMounts` are unaffected.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/fission/fission"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.24.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.23.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/security/advisories/GHSA-v455-mv2v-5g92"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-50563"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/pull/3391"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/commit/e484df8460bb4e8026e24210120602aa7f181f64"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/fission/fission"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/releases/tag/v1.24.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-269", "CWE-284" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-30T18:18:42Z",
    "nvd_published_at" : "2026-06-10T18:17:12Z"
  }
}