HIGH 8.5 GitHub
CVE-2026-50570
Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption
Fission v1.24.0 added PodSpec safety validation for tenant-facing Environment and Function CRDs (`ValidatePodSpecSafety` / `ValidateContainerSafety` admission webhook + `sanitizeContainerSecurityContext` executor merge layer), but the
capability check was implemented as a fixed **denylist of six Linux capabilities** (SYS_ADMIN, NET_ADMIN, SYS_PTRACE, SYS_MODULE, DAC_READ_SEARCH, DAC_OVERRIDE). The denylist omitted **CAP_SYS_TIME**, among others. As a result, a tenant
who could create a Function
Affected Products
- go/github.com/fission/fission <= 1.24.0
References
- https://github.com/advisories/GHSA-qf5v-m7p4-95rp
- https://github.com/fission/fission/security/advisories/GHSA-qf5v-m7p4-95rp
- https://nvd.nist.gov/vuln/detail/CVE-2026-50570
- https://github.com/fission/fission/pull/3465
This high severity vulnerability with a CVSS score of 8.5 was published on 2026-07-28 via GitHub. Affected: go/github.com/fission/fission <= 1.24.0.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.