This vulnerability (CVE-2026-50566) in github.com/fission/fission involves a bypass of PodSpec security hardening due to incomplete validation and sanitization of the Environment CRD's standalone Runtime.Container and Builder.Container SecurityContext fields. The admission webhook validates only Runtime.PodSpec and Builder.PodSpec, ignoring these standalone container fields, which are merged without sanitization. This allows an attacker with appropriate RBAC to create privileged pods or containers with elevated capabilities such as privileged mode, allowPrivilegeEscalation, or SYS_ADMIN capabilities. The flaw affects multiple merge sites and results in pods running with elevated privileges under the executor's high-privilege service account, risking container escape and cluster compromise. The issue is fixed in pull request #3406 and released in version 1.24.0.

An attacker with create/update permissions on the Environment CRD can deploy pods or containers with privileged SecurityContext settings, including privileged mode, allowPrivilegeEscalation, and dangerous Linux capabilities. These pods run under a high-privilege executor service account, enabling potential container escape, host filesystem and network access, and full node or cluster compromise. The blast radius is equivalent to prior PodSpec hardening bypasses addressed in earlier advisories.

A fix is available in Fission version 1.24.0, which adds validation for standalone container SecurityContext fields and sanitizes them during merging. Until upgrading, restrict Environment create/update RBAC permissions to trusted administrators only. Additionally, deploy admission policies (e.g., Kyverno or OPA Gatekeeper) to reject dangerous SecurityContext settings on Environment CRDs, or enforce Kubernetes Pod Security Standards with labels such as pod-security.kubernetes.io/enforce: restricted on function and builder namespaces.