Vulnerability · Published Jun 10, 2026 · Assigned by GitHub_M

CVE-2026-50569Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

Medium 4.3

In plain English

A medium-severity improper input validation in fission from fission. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 86.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, HTTPTriggerSpec.Validate() validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only (pkg/fission-cli/cmd/httptrigger/create.go:83). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via kubectl apply or a direct Kubernetes REST API call bypassed every URL-level check. This issue has been patched in version 1.25.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/fission/fission	1.25.0	GHSA-vchh-r53j-8mpw
Go	github.com/fission/fission	1.25.0	GO-2026-6131

Affected products (as reported)

Vendor	Product	Versions
fission	fission	< 1.25.0

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/fission/fission/security/advisories/GHSA-vchh-r53j-8mpw x_refsource_CONFIRM
https://github.com/fission/fission/pull/3464 x_refsource_MISC
https://github.com/fission/fission/releases/tag/v1.25.0 x_refsource_MISC