This vulnerability (CVE-2026-50545) in github.com/fission/fission involves three compounded flaws: (1) lack of validation for dangerous podSpec fields such as hostPID, hostIPC, hostNetwork, hostPath volumes, and privileged settings in Environment CRD; (2) a webhook that only validates on resource creation, allowing attackers to bypass checks via patch updates; (3) the MergePodSpec function propagates unsafe fields into generated pods without sanitization. An attacker with create/update RBAC on environments.fission.io can apply a benign Environment resource and then patch in dangerous podSpec fields, causing the system to schedule a privileged pod with host root mounts. This pod can read the cluster CA private key, enabling signing of arbitrary kubelet certificates and full cluster takeover. The issue is fixed in pull requests #3391 and #3390 and released in Fission v1.24.0, which adds podSpec validation, extends webhook to update verbs, and sanitizes dangerous fields during merge.

An attacker with create/update permissions on the environments.fission.io resource can escalate privileges to escape node isolation and achieve full cluster takeover by reading the cluster CA private key. This allows signing of arbitrary kubelet certificates, compromising cluster integrity, confidentiality, and availability.

A fix is available in Fission version 1.24.0. This update addresses all identified flaws by adding podSpec validation, extending webhook validation to update operations, and sanitizing dangerous podSpec fields during merge. Users should upgrade to version 1.24.0 or later to remediate this vulnerability.