Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-50563

Fission Container Executor Function PodSpec Injection Leading to Node Escape

Description

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Container Executor path lets a tenant supply Function.spec.podspec directly; the executor merges it into the executor-built podspec and creates a Deployment whose pods run the user's container image. This issue has been patched in version 1.24.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

fission fission

  • < 1.24.0affected

References