Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-50569 EUVD-2026-36073GHSA-vchh-r53j-8mpwGO-2026-6131

Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

Published Jun 10, 2026 · Updated Jun 10, 2026 · Assigned by GitHub_M

Description

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, HTTPTriggerSpec.Validate() validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only (pkg/fission-cli/cmd/httptrigger/create.go:83). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via kubectl apply or a direct Kubernetes REST API call bypassed every URL-level check. This issue has been patched in version 1.25.0.

Affected products

VendorProductAffectedFixed
fission fission < 1.25.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1
SLES 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 openSUSE-SU-2026:21761-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/fission/fission < 1.25.0 1.25.0 GHSA-vchh-r53j-8mpw

Advisories 2

References