# Fission Container Executor Function PodSpec Injection Leading to Node Escape

Fission's container executor merged tenant-supplied Function.spec.podspec without sanitizing host namespaces, hostPath volumes or privileged, letting a functions/create tenant escape to the node.

- Payout: Research
- Severity: critical
- Program: Fission
- Found by: j311yl0v3u, b0b0haha
- Disclosed: 2026-06-30
- CVE: CVE-2026-50563
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-v455-mv2v-5g92
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-v455-mv2v-5g92
- Tags: area:cloud domain:cloud domain:infra impact:internal-access impact:privesc kind:research platform:ghsa sev:critical tech:kubernetes technique:chained technique:source-review vuln:access-control vuln:misconfiguration vuln:privilege-escalation

**Target:** Kubernetes CRD admission/executor Deployment sink (Function.spec.podspec)
**Root cause:** FunctionSpec.Validate only checked spec.PodSpec != nil for executorType container without inspecting content, and MergePodSpec unconditionally forwarded hostPID/hostNetwork/hostIPC, hostPath volumes, serviceAccountName and privileged into the executor-created Deployment.
**Steps:**
1. Tenant holds only `functions.fission.io/create`.
2. Submit a Function with `executorType: container` and a crafted `spec.podspec` setting `hostPID`/`hostNetwork`/`hostIPC`, a hostPath volume mounting the host root filesystem, `serviceAccountName`, and container `privileged: true`.
3. Validation passes because only `spec.PodSpec != nil` is checked.
4. Executor (high-privilege SA with `deployments/create`) calls `util.MergePodSpec` and `getDeploymentSpec`, creating the Deployment with the tenant's pod-security settings.
5. Pod schedules with host root mounted and host namespaces shared, yielding node escape.
**How found:** Compared the Function CRD path against the previously reported Environment CRD sibling advisories (GHSA-gx55-f84r-v3r7 / GHSA-wmgg-3p4h-48x7) and noticed the Function validation only checked PodSpec non-nil while the same MergePodSpec sink forwarded dangerous fields; also noted function developers commonly hold functions/create but not environments/create, lowering the threshold.
**Exploitation:** A tenant with only functions/create submits a Function whose podspec requests privileged, host namespaces and a hostPath mount of the host root; the executor's service account creates the Deployment on the tenant's behalf, so the resulting pod runs with host access and the tenant escapes to the node.
**Escalation:** Function-create privilege is amplified into effective deployments/create with arbitrary pod-security configuration, then into node escape via privileged host-namespace pod.
**Insight:** When a controller merges user-supplied pod templates into its own Deployment, audit every field the merge forwards (host namespaces, hostPath, privileged, serviceAccountName) and check whether the CRD's validating webhook inspects content or only presence; sibling CRDs sharing the same merge sink often carry the same flaw with different RBAC thresholds.