https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 22:50:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326791 EUVD-2026-326791 https://cve.radiocsirt.org/vuln/euvd-2026-326791 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50563 <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission&#39;s Container Executor path lets a tenant supply Function.spec.podspec directly; the executor merges it into the executor-built podspec and creates a Deployment whose pods run the user&#39;s container image. This issue has been patched in version 1.24.0.</p> <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission&#39;s Container Executor path lets a tenant supply Function.spec.podspec directly; the executor merges it into the executor-built podspec and creates a Deployment whose pods run the user&#39;s container image. This issue has been patched in version 1.24.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-50563 https://cve.radiocsirt.org/vuln/ghsa-v455-mv2v-5g92 <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>Fission&#39;s Container Executor path lets a tenant supply `Function.spec.podspec` directly; the executor merges it into the executor-built podspec and creates a Deployment whose pods run the user&#39;s container image.</p> <p>### Details</p> <p>Two flaws compounded:</p> <p>1. `pkg/apis/core/v1/validation.go::FunctionSpec.Validate` only checked that `spec.PodSpec != nil` when `executorType: container`; it did not inspect the content of `spec.PodSpec`. 2. `pkg/executor/util/merge.go::MergePodSpec` unconditionally forwarded `hostPID`, `hostNetwork`, `hostIPC`, hostPath volumes, `serviceAccountName`, and container `privileged` into the Deployment spec via the container-executor sink (`pkg/executor/executortype/container/deployment.go::getDeploymentSpec`).</p> <p>A tenant with only `functions.fission.io/create` could deploy a Function with a crafted podspec that mounted the host root filesystem and shared host namespaces. The executor — running under its high-privilege SA, which holds `deployments/create` on the function namespace — created that Deployment on the tenant&#39;s behalf, turning Function-create into effective `deployments/create` with arbitrary pod-security configuration.</p> <p>This is the Function-CRD sibling of GHSA-gx55-f84r-v3r7 / GHSA-wmgg-3p4h-48x7, with a **lower** attack threshold: regular function developers typically hold `functions/create` but not `environments/create`.</p> <p>### Impact</p> <p>A tenant with only `functions.fission.io/create` is escalated to node escape via a privileged, host-n…</p> <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>Fission&#39;s Container Executor path lets a tenant supply `Function.spec.podspec` directly; the executor merges it into the executor-built podspec and creates a Deployment whose pods run the user&#39;s container image.</p> <p>### Details</p> <p>Two flaws compounded:</p> <p>1. `pkg/apis/core/v1/validation.go::FunctionSpec.Validate` only checked that `spec.PodSpec != nil` when `executorType: container`; it did not inspect the content of `spec.PodSpec`. 2. `pkg/executor/util/merge.go::MergePodSpec` unconditionally forwarded `hostPID`, `hostNetwork`, `hostIPC`, hostPath volumes, `serviceAccountName`, and container `privileged` into the Deployment spec via the container-executor sink (`pkg/executor/executortype/container/deployment.go::getDeploymentSpec`).</p> <p>A tenant with only `functions.fission.io/create` could deploy a Function with a crafted podspec that mounted the host root filesystem and shared host namespaces. The executor — running under its high-privilege SA, which holds `deployments/create` on the function namespace — created that Deployment on the tenant&#39;s behalf, turning Function-create into effective `deployments/create` with arbitrary pod-security configuration.</p> <p>This is the Function-CRD sibling of GHSA-gx55-f84r-v3r7 / GHSA-wmgg-3p4h-48x7, with a **lower** attack threshold: regular function developers typically hold `functions/create` but not `environments/create`.</p> <p>### Impact</p> <p>A tenant with only `functions.fission.io/create` is escalated to node escape via a privileged, host-n…</p> https://cve.radiocsirt.org/vuln/ghsa-v455-mv2v-5g92