https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 11:08:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326835 EUVD-2026-326835 https://cve.radiocsirt.org/vuln/euvd-2026-326835 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50566 <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a tenant with environments.fission.io create/update RBAC can run privileged / allowPrivilegeEscalation / dangerous-capability containers in the Fission function or builder namespace, scheduled under the executor&#39;s high-privilege service account — enabling container-sandbox escape, host filesystem and network access, and potential node- and cluster-level compromise. This issue has been patched in version 1.24.0.</p> <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a tenant with environments.fission.io create/update RBAC can run privileged / allowPrivilegeEscalation / dangerous-capability containers in the Fission function or builder namespace, scheduled under the executor&#39;s high-privilege service account — enabling container-sandbox escape, host filesystem and network access, and potential node- and cluster-level compromise. This issue has been patched in version 1.24.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-50566 https://cve.radiocsirt.org/vuln/ghsa-m63v-2g9w-2w6v <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>A follow-up bypass of the round-4 PodSpec hardening (GHSA-gx55-f84r-v3r7, GHSA-wmgg-3p4h-48x7, GHSA-v455-mv2v-5g92). Those advisories validate and sanitize the `PodSpec` (`spec.runtime.podSpec` / `spec.builder.podSpec` / `function.spec.podSpec`), but the Environment CRD also exposes `spec.runtime.container` and `spec.builder.container` — a standalone `Container` merged into the runtime/builder pod whose `SecurityContext` bypassed both layers.</p> <p>### Details</p> <p>**Admission-layer gap.** `Environment.Validate()` calls `ValidatePodSpecSafety()` on `Runtime.PodSpec` and `Builder.PodSpec` only. That function takes a `*PodSpec`, so it never inspects the standalone `Runtime.Container.SecurityContext` or `Builder.Container.SecurityContext`.</p> <p>**Merge-layer gap.** `sanitizeContainerSecurityContext()` ran only inside `MergePodSpec()`. The container field is merged via `MergeContainer()`, which did not sanitize. With only `Runtime.Container` set and `Runtime.PodSpec` nil, `MergePodSpec` is never invoked, so the sanitizer never ran.</p> <p>Affected merge sites: poolmgr (`gp_deployment.go`), newdeploy (`newdeploy.go`), and buildermgr (`envwatcher.go`).</p> <p>#### Proof of concept</p> <p>```yaml apiVersion: fission.io/v1 kind: Environment metadata: name: priv-escape-test namespace: default spec: version: 3 runtime: image: &#34;ghcr.io/fission/python-env:latest&#34; container: name: priv-escape-test securityContext: privileged: true poolsize: 1 ```</p> <p>The admission webhoo…</p> <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>A follow-up bypass of the round-4 PodSpec hardening (GHSA-gx55-f84r-v3r7, GHSA-wmgg-3p4h-48x7, GHSA-v455-mv2v-5g92). Those advisories validate and sanitize the `PodSpec` (`spec.runtime.podSpec` / `spec.builder.podSpec` / `function.spec.podSpec`), but the Environment CRD also exposes `spec.runtime.container` and `spec.builder.container` — a standalone `Container` merged into the runtime/builder pod whose `SecurityContext` bypassed both layers.</p> <p>### Details</p> <p>**Admission-layer gap.** `Environment.Validate()` calls `ValidatePodSpecSafety()` on `Runtime.PodSpec` and `Builder.PodSpec` only. That function takes a `*PodSpec`, so it never inspects the standalone `Runtime.Container.SecurityContext` or `Builder.Container.SecurityContext`.</p> <p>**Merge-layer gap.** `sanitizeContainerSecurityContext()` ran only inside `MergePodSpec()`. The container field is merged via `MergeContainer()`, which did not sanitize. With only `Runtime.Container` set and `Runtime.PodSpec` nil, `MergePodSpec` is never invoked, so the sanitizer never ran.</p> <p>Affected merge sites: poolmgr (`gp_deployment.go`), newdeploy (`newdeploy.go`), and buildermgr (`envwatcher.go`).</p> <p>#### Proof of concept</p> <p>```yaml apiVersion: fission.io/v1 kind: Environment metadata: name: priv-escape-test namespace: default spec: version: 3 runtime: image: &#34;ghcr.io/fission/python-env:latest&#34; container: name: priv-escape-test securityContext: privileged: true poolsize: 1 ```</p> <p>The admission webhoo…</p> https://cve.radiocsirt.org/vuln/ghsa-m63v-2g9w-2w6v