Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Fission before 1.24 lets code escape its container

CVE-2026-50563 · published 4 months ago
Summary

The Fission serverless platform (versions before 1.24) lets a user supply custom configuration that is merged into the system’s own settings. This can cause the user’s code to break out of its isolated container and run on the host machine. Upgrade to Fission 1.24 or later to stop this behavior.

What to do
  • Update github.com fission to version 1.24.0.
Affected software
Ecosystem VendorProductAffected versions
go github.com fission <= 1.23.0
Fix: upgrade to 1.24.0
Original advisory text
Fission Container Executor Function PodSpec Injection Leading to Node Escape
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Container Executor path lets a tenant supply Function.spec.podspec directly; the executor merges it into the executor-built podspec and creates a Deployment whose pods run the user's container image. This issue has been patched in version 1.24.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
CWE-284Improper Access Control
Timeline
Published10 Jun 2026
Updated3 Nov 2026
First seen10 Jun 2026
Sources
CVE-2026-50563 · NVD
GHSA-v455-mv2v-5g92 · GHSA
CVE-2026-50563 · OSV
Track software like this
Free during beta