# Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape

Fission Environment CRD merged user-supplied podSpec fields unfiltered, letting namespace users create privileged hostPID/hostNetwork pods and escape to node compromise.

- Payout: Research
- Severity: critical
- Program: Fission
- Found by: 0xVijay
- Disclosed: 2026-06-30
- CVE: CVE-2026-50564
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-gx55-f84r-v3r7
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-gx55-f84r-v3r7
- Tags: area:cloud domain:cloud impact:internal-access impact:privesc kind:research platform:ghsa sev:critical tech:kubernetes technique:source-review vuln:access-control vuln:misconfiguration vuln:privilege-escalation

**Target:** Kubernetes Environment CRD (spec.runtime.podSpec / spec.builder.podSpec) merged into runtime and builder pods
**Root cause:** The podspec merge logic propagated hostNetwork, hostPID, hostIPC, container privileged, and serviceAccountName from user-supplied Environment podSpecs with no filtering, and Environment.Validate performed no security-relevant checks on these fields.
**Steps:**
1. As a namespace user with create/update on `environments.fission.io`, submit an Environment whose `spec.runtime.podSpec` (or `spec.builder.podSpec`) sets `hostNetwork: true`, `hostPID: true`, and a container `securityContext.privileged: true`.
2. Fission merges these fields into the runtime/builder pod spec unfiltered; Pod Security Admission does not block it because `fission-function`/`fission-builder` namespaces lack `pod-security.kubernetes.io/enforce` labels.
3. The privileged host-network hostPID pod schedules; from it run `nsenter` into the host PID namespace.
4. Read cloud-metadata credentials and access the container-runtime socket to pivot to other namespaces and compromise the node.
**Exploitation:** Attacker with Environment create/update RBAC submits a podSpec with hostPID/hostNetwork/privileged; the resulting pod runs on the node with host namespaces, enabling nsenter to host, metadata credential theft, runtime socket access, and cluster-wide pivot.
**Escalation:** Environment CRD write RBAC escalated to node compromise, then cluster-wide takeover via stolen metadata credentials and runtime socket.
**Insight:** When a CRD embeds a Kubernetes podSpec, audit the merge path for host-namespace and privileged fields, and check whether the target namespace carries PSA enforce labels — the CRD's own validation often ignores security-relevant pod fields entirely.