# Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

Fission's Environment CRD podSpec passthrough lacked validation and the webhook only fired on create, letting a tenant patch in hostPID/hostPath/privileged and escape to node root, then read the cluster CA key.

- Payout: Research
- Severity: critical
- Program: Fission
- Found by: j311yl0v3u, b0b0haha
- Disclosed: 2026-06-30
- CVE: CVE-2026-50545
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-wmgg-3p4h-48x7
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-wmgg-3p4h-48x7
- Tags: area:cloud domain:cloud domain:infra impact:internal-access impact:privesc kind:research platform:ghsa sev:critical tech:kubernetes technique:source-review vuln:access-control vuln:misconfiguration vuln:privilege-escalation

**Target:** Kubernetes CRD (environments.fission.io) and admission webhook
**Root cause:** Environment.Validate only checked container naming, never hostPID/hostIPC/hostNetwork/hostPath/privileged; the validating webhook was registered with verbs=create only, so updates bypassed it; and MergePodSpec unconditionally copied HostPID, HostIPC, HostNetwork, Volumes, SecurityContext and ServiceAccountName into generated Deployments.
**Steps:**
1. `kubectl apply` a clean Environment resource (passes create-time webhook)
2. `kubectl patch` the same Environment to add `hostPID`/`hostNetwork`, a `hostPath` volume mounting host root, `privileged: true`, and a privileged ServiceAccountName — webhook not invoked on update
3. poolmgr/newdeploy/buildermgr MergePodSpec forwards those fields into the generated Deployment; a privileged pod with host-root mount is scheduled within ~20 seconds
4. From that pod, read the cluster CA private key and sign arbitrary kubelet certificates
**How found:** Code review of the CRD validation path and webhook registration: noticed Validate never inspected security-sensitive podSpec fields, the kubebuilder marker listed only verbs=create, and MergePodSpec blindly forwarded dangerous fields.
**Exploitation:** Tenant with only environments.fission.io create/update RBAC applies a benign Environment then patches in host namespaces, hostPath root mount and privileged securityContext; the executor schedules the pod, giving host filesystem access and read of the cluster CA key, from which forged kubelet certs yield full cluster takeover.
**Escalation:** CRD write permission → privileged pod with host-root mount → node escape → cluster CA key read → forged kubelet certificates → full cluster takeover.
**Insight:** When a CRD embeds a PodSpec passthrough, check both the validation function's field allowlist and the admission webhook's verbs list — a create-only webhook means the real attack is apply-then-patch, and the merge layer that builds the workload is the last place to catch it.