GHSA-7m8x-qg2j-4m3v GO-2026-5849
Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec
- Severity
- 8.1 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-269 Improper Privilege Management
- CWE-284 Improper Access Control
- Fix
1.24.0- Upgrade github.com/fission/fission to this version or later
Description
Summary
The Fission MessageQueueTrigger (MQT) scaler controller exposed two privilege-escalation primitives to any subject able to create MQTs in a namespace.
Details
1. Secret materialization. getEnvVarlist in pkg/mqtrigger/scalermanager.go read the Secret named in Spec.Secret using the controller's cluster-wide secrets/get RBAC and emitted each key as a literal EnvVar.Value, copying
the plaintext secret content into the connector Deployment's pod template. A subject holding messagequeuetriggers/create but not secrets/get could exfiltrate any Secret in the namespace by pointing an MQT at it.
2. PodSpec injection. Spec.PodSpec was merged into the controller-built connector PodSpec via util.MergePodSpec with no allowlist on which fields could come from the user. An MQT could substitute Containers[].Image (run any
image), override Command/Args, inject Env, add VolumeMounts + Volumes, override ServiceAccountName, and set HostNetwork/HostPID/HostIPC — turning messagequeuetriggers/create into effective deployments/create with an
arbitrary image and service account.
Impact
A tenant with only messagequeuetriggers.fission.io/create in a namespace could read any Secret in that namespace and run an arbitrary container image under an arbitrary service account, escalating well beyond their intended RBAC.
Fix
Fixed in #3367 and released in v1.24.0.
getEnvVarlistnow emitsEnvVar.ValueFrom.SecretKeyRefso the connector pod resolves values at start time under its own service account. The secret values are never written into the Deployment object and never logged.- A new allowlist,
MergeAllowedPodSpecFields(pkg/executor/util/merge_allowlist.go), accepts onlyNodeSelector,Tolerations,Affinity,RuntimeClassName, and per-containerResources. All other user-supplied fields are dropped at the controller layer, and the validating webhook rejects every populated non-allowlisted field with a clear error. The webhook and the merge helper share a single canonicalDisallowedPodSpecFieldsenumeration so they cannot drift.
Behavioural change
MQT authors that previously overrode the connector image, command, args, env, volumes, service account, or host namespaces via Spec.PodSpec will see those fields rejected at admission (or silently dropped if the webhook is disabled).
Allowlisted fields flow through unchanged.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/fission/fission | < 1.24.0 |
1.24.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/fission/fission Go → 1.24.0
- go
go get github.com/fission/fission@v1.24.0 && go mod tidy
Severity breakdown
CVSS 3.1 8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
- Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-qf5v-m7p4-95rp Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption | High | Also affects github.com/fission/fission |
| GHSA-vchh-r53j-8mpw Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks | Medium | Also affects github.com/fission/fission |
| GHSA-r5jh-q2mw-gcx4 Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape | Low | Also affects github.com/fission/fission |
| GHSA-q6vm-xqc9-v3ff Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory | High | Also affects github.com/fission/fission |
| GHSA-m63v-2g9w-2w6v Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation | Critical | Also affects github.com/fission/fission |
| GHSA-8wcj-mfrc-jx5q Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container | Medium | Also affects github.com/fission/fission |
| GHSA-gx55-f84r-v3r7 Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape | Critical | Also affects github.com/fission/fission |
| GHSA-v455-mv2v-5g92 Fission Container Executor Function PodSpec Injection Leading to Node Escape | Critical | Also affects github.com/fission/fission |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor