Threats tagged 'ghsa-wmgg-3p4h-48x7'

A vulnerability in Fission's Environment CRD allows attackers with create/update RBAC on environments.fission.io to inject unsafe PodSpec fields, leading to node escape and full cluster takeover. The issue arises from insufficient validation of podSpec fields, a webhook that only validates on create but not update, and unsafe merging of podSpec fields into generated pods. Exploitation enables scheduling privileged pods with host root mounts, exposing the cluster CA private key and allowing signing of arbitrary kubelet certificates. The flaw is fixed in Fission v1.24.0 by adding validation, extending webhook coverage to updates, and sanitizing dangerous podSpec fields during merge.