# Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

Fission Environment CRD's standalone runtime/builder Container SecurityContext skipped PodSpec validation and sanitization, letting tenants create privileged pods under the executor's service account.

- Payout: Research
- Severity: critical
- Program: Fission
- Found by: HiyokoSauna37
- Disclosed: 2026-06-30
- CVE: CVE-2026-50566
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-m63v-2g9w-2w6v
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-m63v-2g9w-2w6v
- Tags: area:cloud domain:cloud domain:infra impact:internal-access impact:privesc kind:research platform:ghsa sev:critical tech:kubernetes technique:incomplete-fix technique:source-review vuln:access-control vuln:misconfiguration vuln:privilege-escalation

**Target:** Kubernetes Environment CRD admission webhook and pod merge logic
**Root cause:** ValidatePodSpecSafety() only takes a *PodSpec and never inspects standalone Runtime.Container/Builder.Container SecurityContext; sanitizeContainerSecurityContext() ran only in MergePodSpec(), not MergeContainer(), so a Container-only Environment bypassed both layers.
**Steps:**
1. Create an Environment with `spec.runtime.container.securityContext.privileged: true` and no `spec.runtime.podSpec`
2. Submit it; the admission webhook accepts it because Validate() only checks PodSpec
3. MergePodSpec is never invoked (PodSpec nil), so MergeContainer merges the unsanitized container
4. Resulting poolmgr/newdeploy/builder pod runs with `privileged: true`
5. Repeat with `allowPrivilegeEscalation: true` or `capabilities.add: ["SYS_ADMIN"]` / `["NET_ADMIN","SYS_PTRACE"]`, or via `spec.builder.container`
**How found:** Follow-up to round-4 PodSpec hardening advisories: noticed the Environment CRD exposes a separate Container field merged via a different path (MergeContainer) than the sanitized PodSpec path, and that validation only accepted *PodSpec.
**Exploitation:** A tenant with environments.fission.io create/update RBAC submits a crafted Environment; the resulting function or builder pod runs privileged under the executor's high-privilege service account, enabling container-sandbox escape and host filesystem/network access.
**Escalation:** Privileged container under executor service account enables node- and cluster-level compromise; same blast radius as GHSA-gx55-f84r-v3r7.
**Insight:** When a CRD exposes both a composite object (PodSpec) and its sub-fields (Container) as independent inputs, check whether validation/sanitization is keyed to the composite type only — a nil composite skips the whole check while the sub-field still merges.

## Proof of concept (copied exactly from the original report)

**Environment YAML with privileged runtime container**

```
apiVersion: fission.io/v1
kind: Environment
metadata:
  name: priv-escape-test
  namespace: default
spec:
  version: 3
  runtime:
    image: "ghcr.io/fission/python-env:latest"
    container:
      name: priv-escape-test
      securityContext:
        privileged: true
  poolsize: 1

The admission webhook accepts this Environment and the resulting pool pod runs with `privileged: true`.
```