The vulnerability in Fission's MessageQueueTrigger scaler controller prior to v1.24.0 involves two privilege escalation vectors. The controller's getEnvVarlist function read Secrets using cluster-wide RBAC and embedded plaintext Secret values directly into Deployment environment variables, allowing users with messagequeuetriggers/create permission to exfiltrate Secrets without having secrets/get permission. Additionally, the Spec.PodSpec field was merged into the connector PodSpec without restrictions, enabling arbitrary container image execution, command overrides, environment injection, volume mounts, service account changes, and host namespace access. This effectively elevated messagequeuetriggers/create permission to deployment creation with arbitrary privileges. The issue was fixed in PR #3367 and released in v1.24.0 by switching to EnvVar.ValueFrom.SecretKeyRef for Secrets and enforcing a strict allowlist on PodSpec fields with admission webhook validation.

An attacker with only the messagequeuetriggers.fission.io/create permission in a namespace could read any Secret in that namespace by referencing it in the MQT Spec.Secret field, bypassing RBAC restrictions. Furthermore, the attacker could execute arbitrary container images with arbitrary service accounts and host-level privileges by injecting malicious PodSpec fields, effectively escalating privileges beyond their intended scope. This leads to confidentiality breaches of Secrets and integrity risks from unauthorized container execution.

This vulnerability is fixed in Fission version 1.24.0. Users should upgrade to v1.24.0 or later to apply the official fix. The fix changes Secret handling to use SecretKeyRef references, preventing plaintext Secret exposure, and restricts PodSpec injection to a strict allowlist enforced by a validating webhook. No additional mitigations are required if upgraded. Patch status is confirmed fixed in v1.24.0.