CVE-2026-50545: Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

Synopsis

This is a PodSpec injection vulnerability in the Fission Kubernetes-native serverless framework affecting versions prior to 1.24.0. An authenticated attacker with low-privilege access can reach the vulnerable API over the network and inject arbitrary fields into the PodSpec of generated pods, which propagate through the MergePodSpec mechanism without validation. Successful exploitation allows the attacker to escape the pod sandbox, gain control of the underlying node, and achieve full cluster takeover. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Fission API service over the network; the vulnerability is exposed via a network-accessible endpoint.

• AuthenticationRequired

  A valid account is required, but any low-privilege credential is sufficient; no administrative role is needed.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the injection entirely on their own.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, specific memory layout, or environmental prerequisite is required.

Blast Radius

• A successful attacker can inject privileged or host-path mounts into generated pod definitions, breaking out of the pod sandbox onto the underlying Kubernetes node.
• With node-level access, the attacker reads secrets, service-account tokens, and kubeconfig material stored on the node, exposing cluster credentials.
• The attacker can modify or delete workloads and persistent data across the cluster by using the harvested cluster credentials.
• Node compromise in a shared cluster disrupts all workloads co-scheduled on that node, causing service outages beyond the Fission environment itself.