The Fission MessageQueueTrigger (MQT) scaler controller in versions prior to 1.24.0 allowed privilege escalation by exposing two critical flaws. First, it copied plaintext Secret values into Deployment environment variables, enabling users with MQT creation rights but without Secret read permissions to exfiltrate Secrets. Second, it allowed arbitrary user PodSpec injection without restrictions, permitting attackers to run containers with arbitrary images and service accounts, effectively escalating to deployment creation privileges. These issues were fixed in version 1.24.0 by changing Secret handling to use SecretKeyRef references and introducing a strict allowlist for PodSpec fields.