MEDIUM 4.3 GitHub
CVE-2026-50569
Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks
`HTTPTriggerSpec.Validate()` validated `Methods`, `FunctionReference`, `Host`, `IngressConfig`, and `CorsConfig`, but silently skipped `RelativeURL` and `Prefix`. Those two fields were validated at the CLI level only
(`pkg/fission-cli/cmd/httptrigger/create.go:83`). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via `kubectl apply` or
a direct Kubernetes REST API call bypassed eve
Affected Products
- go/github.com/fission/fission <= 1.24.0
References
- https://github.com/advisories/GHSA-vchh-r53j-8mpw
- https://github.com/fission/fission/security/advisories/GHSA-vchh-r53j-8mpw
- https://nvd.nist.gov/vuln/detail/CVE-2026-50569
- https://github.com/fission/fission/pull/3464
This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-07-28 via GitHub. Affected: go/github.com/fission/fission <= 1.24.0.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.