https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T16:03:18.390549+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-326835 EUVD-2026-326835 2026-10-07T16:03:18.434877+00:00 EUVD-2026-326835 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50566 fkie_cve-2026-50566 2026-10-07T16:03:18.434913+00:00

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a tenant with environments.fission.io create/update RBAC can run privileged / allowPrivilegeEscalation / dangerous-capability containers in the Fission function or builder namespace, scheduled under the executor's high-privilege service account — enabling container-sandbox escape, host filesystem and network access, and potential node- and cluster-level compromise. This issue has been patched in version 1.24.0.

 https://cve.radiocsirt.org/vuln/ghsa-m63v-2g9w-2w6v GHSA-m63v-2g9w-2w6v — Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation 2026-10-07T16:03:18.434959+00:00

Affected: Go: github.com/fission/fission

### Summary

A follow-up bypass of the round-4 PodSpec hardening (GHSA-gx55-f84r-v3r7, GHSA-wmgg-3p4h-48x7, GHSA-v455-mv2v-5g92). Those advisories validate and sanitize the `PodSpec` (`spec.runtime.podSpec` / `spec.builder.podSpec` / `function.spec.podSpec`), but the Environment CRD also exposes `spec.runtime.container` and `spec.builder.container` — a standalone `Container` merged into the runtime/builder pod whose `SecurityContext` bypassed both layers.

### Details

**Admission-layer gap.** `Environment.Validate()` calls `ValidatePodSpecSafety()` on `Runtime.PodSpec` and `Builder.PodSpec` only. That function takes a `*PodSpec`, so it never inspects the standalone `Runtime.Container.SecurityContext` or `Builder.Container.SecurityContext`.

**Merge-layer gap.** `sanitizeContainerSecurityContext()` ran only inside `MergePodSpec()`. The container field is merged via `MergeContainer()`, which did not sanitize. With only `Runtime.Container` set and `Runtime.PodSpec` nil, `MergePodSpec` is never invoked, so the sanitizer never ran.

Affected merge sites: poolmgr (`gp_deployment.go`), newdeploy (`newdeploy.go`), and buildermgr (`envwatcher.go`).

#### Proof of concept

```yaml apiVersion: fission.io/v1 kind: Environment metadata: name: priv-escape-test namespace: default spec: version: 3 runtime: image: "ghcr.io/fission/python-env:latest" container: name: priv-escape-test securityContext: privileged: true poolsize: 1 ```

The admission webhoo…