CVE-2026-50545: Github.com/fission/fission Fission Environment CRD PodSpec Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wmgg-3p4h-48x7",
  "modified" : "2026-06-30T18:18:05Z",
  "published" : "2026-06-30T18:18:05Z",
  "aliases" : [ "CVE-2026-50545" ],
  "summary" : "Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover",
  "details" : "### Summary\n\nA stronger framing of the same root cause as GHSA-gx55-f84r-v3r7: the `Environment.spec.runtime.podSpec` / `spec.builder.podSpec` passthrough lacked validation, and `MergePodSpec` propagated dangerous fields into the generated pods.\n\n### Details\n\nThree independent flaws compounded:\n\n1. **Validate gap.** `pkg/apis/core/v1/validation.go::Environment.Validate` checked only container naming conventions, never `hostPID`/`hostIPC`/`hostNetwork`/`hostPath`/`privileged`.\n2. **UPDATE bypass.** The `pkg/webhook/environment.go` kubebuilder marker registered `verbs=create` only. A tenant could `kubectl apply` a clean Environment and then `kubectl patch` in the dangerous fields — the webhook was never called.\n3. **Merge propagation.** `pkg/executor/util/merge.go::MergePodSpec` unconditionally forwarded `HostPID`, `HostIPC`, `HostNetwork`, `Volumes` (including hostPath), `SecurityContext`, and `ServiceAccountName` into the Deployments\ngenerated by poolmgr / newdeploy / buildermgr.\n\nA `kubectl apply` plus a follow-up `kubectl patch` caused poolmgr to schedule a privileged pod with a host-root mount within roughly 20 seconds. From that pod the cluster CA private key was readable, allowing the attacker to sign\narbitrary kubelet certificates and achieve full cluster takeover.\n\n### Impact\n\n`environments.fission.io` create/update RBAC is escalated to node escape and, via the readable cluster CA key, full cluster takeover.\n\n### Fix\n\nFixed in [#3391](https://github.com/fission/fission/pull/3391) (with the companion buildermgr SA-token fix in [#3390](https://github.com/fission/fission/pull/3390)) and released in\n[v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0). Each enumerated flaw is addressed:\n\n1. **Validate** — `ValidatePodSpecSafety` is called from `Environment.Validate` for both `Runtime.PodSpec` and `Builder.PodSpec`.\n2. **UPDATE bypass** — the webhook marker is extended to `verbs=create;update`; chart and envtest manifests are aligned.\n3. **Merge propagation** — host namespaces, `ServiceAccountName`, and hostPath volumes are stripped at the merge layer; per-container `privileged`/`allowPrivilegeEscalation` and dangerous capabilities are sanitized.\n\nSee GHSA-gx55-f84r-v3r7 for the detailed fix — both advisories close to the same commit.\n\n### Duplicate handling\n\nThis advisory and GHSA-gx55-f84r-v3r7 were reported separately but close to the same code fix. Both are published to acknowledge each reporter's contribution and to keep the public CVE record clear about the multi-layer nature of the\nissue.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/fission/fission"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.24.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.23.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/security/advisories/GHSA-wmgg-3p4h-48x7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-50545"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/pull/3390"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/pull/3391"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/commit/8fa799417c77ce8a0189d9858bfe11ece29b84a6"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/commit/e484df8460bb4e8026e24210120602aa7f181f64"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/fission/fission"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fission/fission/releases/tag/v1.24.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-269", "CWE-284", "CWE-693" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-30T18:18:05Z",
    "nvd_published_at" : "2026-06-10T18:17:12Z"
  }
}