https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T03:19:00.430742+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-326790 EUVD-2026-326790 2026-10-07T03:19:00.478112+00:00 EUVD-2026-326790 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50545 fkie_cve-2026-50545 2026-10-07T03:19:00.478150+00:00

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Environment.spec.runtime.podSpec / spec.builder.podSpec passthrough lacked validation, and MergePodSpec propagated dangerous fields into the generated pods. This issue has been patched in version 1.24.0.

 https://cve.radiocsirt.org/vuln/ghsa-wmgg-3p4h-48x7 GHSA-wmgg-3p4h-48x7 — Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover 2026-10-07T03:19:00.478184+00:00

Affected: Go: github.com/fission/fission

### Summary

A stronger framing of the same root cause as GHSA-gx55-f84r-v3r7: the `Environment.spec.runtime.podSpec` / `spec.builder.podSpec` passthrough lacked validation, and `MergePodSpec` propagated dangerous fields into the generated pods.

### Details

Three independent flaws compounded:

1. **Validate gap.** `pkg/apis/core/v1/validation.go::Environment.Validate` checked only container naming conventions, never `hostPID`/`hostIPC`/`hostNetwork`/`hostPath`/`privileged`. 2. **UPDATE bypass.** The `pkg/webhook/environment.go` kubebuilder marker registered `verbs=create` only. A tenant could `kubectl apply` a clean Environment and then `kubectl patch` in the dangerous fields — the webhook was never called. 3. **Merge propagation.** `pkg/executor/util/merge.go::MergePodSpec` unconditionally forwarded `HostPID`, `HostIPC`, `HostNetwork`, `Volumes` (including hostPath), `SecurityContext`, and `ServiceAccountName` into the Deployments generated by poolmgr / newdeploy / buildermgr.

A `kubectl apply` plus a follow-up `kubectl patch` caused poolmgr to schedule a privileged pod with a host-root mount within roughly 20 seconds. From that pod the cluster CA private key was readable, allowing the attacker to sign arbitrary kubelet certificates and achieve full cluster takeover.

### Impact

`environments.fission.io` create/update RBAC is escalated to node escape and, via the readable cluster CA key, full cluster takeover.

### Fix

Fixed in [#3391](https://github.com/fission/fissio…