# Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec

Fission MQT scaler copied Secret values into connector Deployment envvars and merged arbitrary user PodSpec, letting MQT creators read secrets and run arbitrary images.

- Payout: Research
- Severity: high
- Program: Fission
- Found by: FORIMOC, nnin-nnin
- Disclosed: 2026-06-30
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-7m8x-qg2j-4m3v
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-7m8x-qg2j-4m3v
- Tags: area:cloud domain:cloud domain:infra impact:data-leak impact:privesc kind:research platform:ghsa sev:high tech:kubernetes technique:source-review vuln:access-control vuln:secrets-leak

**Target:** Kubernetes MessageQueueTrigger scaler controller (pkg/mqtrigger/scalermanager.go)
**Root cause:** getEnvVarlist read Spec.Secret via the controller's cluster-wide secrets/get RBAC and wrote plaintext values as EnvVar.Value into the connector Deployment; Spec.PodSpec was merged via util.MergePodSpec with no field allowlist.
**Steps:**
1. Create a MessageQueueTrigger in a namespace where you hold only messagequeuetriggers/create.
2. Set `Spec.Secret` to the name of any Secret in the namespace; controller reads it with its own secrets/get and emits each key as literal `EnvVar.Value` in the connector Deployment pod template.
3. Read the materialized plaintext from the resulting Deployment spec.
4. Alternatively set `Spec.PodSpec` with `Containers[].Image`, `Command`/`Args`, `Env`, `VolumeMounts`+`Volumes`, `ServiceAccountName`, or `HostNetwork`/`HostPID`/`HostIPC`; MergePodSpec applies them to the controller-built connector pod.
**How found:** Code review of the scaler manager: noticed getEnvVarlist resolving secrets under the controller's RBAC and MergePodSpec accepting user fields without an allowlist.
**Exploitation:** A tenant with only messagequeuetriggers/create points an MQT at a target Secret to exfiltrate its plaintext via the generated Deployment, or injects a PodSpec to run an arbitrary image under an arbitrary service account with host namespaces, escalating to effective deployments/create.
**Escalation:** Chaining secret read plus arbitrary pod/service account control turns a narrow MQT-create permission into namespace-wide secret access and arbitrary workload execution.
**Insight:** When a controller resolves user-referenced Secrets under its own cluster-wide RBAC, the reference itself is a confused-deputy read primitive; prefer ValueFrom.SecretKeyRef so the pod resolves under its own SA. Also audit any MergePodSpec-style helper for missing field allowlists.