CVE-2026-50570

The record

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs (ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer), but the capability check was implemented as a fixed denylist of six Linux capabilities (SYS_ADMIN, NET_ADMIN, SYS_PTRACE, SYS_MODULE, DAC_READ_SEARCH, DAC_OVERRIDE). The denylist omitted CAP_SYS_TIME, among others. As a result, a tenant who could create a Function or Environment CRD could request securityContext.capabilities.add: ["SYS_TIME"], pass Fission's admission validation and merge-layer sanitization, and run attacker-controlled code with CAP_SYS_TIME in the resulting function or runtime container. This issue has been patched in version 1.25.0.

Affected packages

Related vulnerabilities

• CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability… CWE-269
• CVE-2026-53614 util-linux is a random collection of Linux utilities. CWE-269
• CVE-2026-95837 containerd is an open-source container runtime. CWE-269
• CVE-2026-63349 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-269
• CVE-2026-92957 vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating… CWE-269
• CVE-2026-92958 vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. CWE-269
• CVE-2026-74925 The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role… CWE-269
• CVE-2026-75777 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape… CWE-269