Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• high

  Fission MessageQueueTrigger Secret Exfiltration and PodSpec Injection

  Any Kubernetes tenant who can create a Fission MessageQueueTrigger can read any Secret in the namespace and run an arbitrary container image under any service account, far beyond their intended RBAC…

• highCVE-2026-49821

  CVE-2026-49821: Fission Package Cross-Namespace Confused Deputy RCE and SA Token Exfiltration

  A Fission user in one Kubernetes namespace could trick the build controller into running their code inside another tenant's builder pod and leaking that namespace's service-account token, giving the…

• highCVE-2026-49822

  CVE-2026-49822: Fission KubernetesWatchTrigger Cross-Namespace Event Leakage

  A low-privilege Fission tenant could spy on Pods, Services, and Jobs in any Kubernetes namespace, or even the entire cluster, by creating a watch trigger that pointed its spec.namespace at a…

• highCVE-2026-49823

  CVE-2026-49823: Fission Cross-Namespace Package Read via Unvalidated PackageRef

  A low-privilege Fission function author in one Kubernetes namespace could read the source code and embedded secrets of any Package in any other namespace by setting a single field the admission…

• highCVE-2026-49824

  CVE-2026-49824: Fission Cross-Namespace Environment Reference via Unvalidated EnvironmentRef

  A Fission tenant with permission to create Functions in their own namespace could point a Function at another tenant's Environment CRD, causing their code to run inside the victim's container image…

• criticalCVE-2026-50545

  CVE-2026-50545: Fission Environment PodSpec Injection Leading to Node Escape and Cluster Takeover

  A tenant with basic Kubernetes RBAC on Fission's Environment CRD can inject privileged pod settings through a two-step apply-then-patch that bypasses the admission webhook, causing poolmgr to…

• criticalCVE-2026-50563

  CVE-2026-50563: Fission Container Executor PodSpec Injection Leading to Node Escape

  A Fission user with only the ability to create functions can craft a malicious pod spec that tricks the executor into scheduling a privileged, host-namespace pod, escaping to the underlying…

• criticalCVE-2026-50564

  CVE-2026-50564: Fission Environment PodSpec Passthrough Privilege Escalation to Node Escape

  Any user with permission to create or update a Fission Environment can craft a manifest that spins up a privileged, host-network pod, giving them full access to the underlying Kubernetes node and…

• criticalCVE-2026-50566

  CVE-2026-50566: Fission Environment Container SecurityContext Bypass Allows Privileged Pod Creation

  A gap in Fission's admission and merge-layer validation lets any tenant with Environment create/update access spin up fully privileged Kubernetes pods, enabling container escape and potential…

• highCVE-2026-49451

  CVE-2026-49451: Microsoft.OpenAPI Uncontrolled Recursion via Circular Schema References

  A tiny OpenAPI document with two schemas that point at each other can exhaust the call stack and terminate any .NET process that parses it using Microsoft.OpenAPI.

• highCVE-2026-44840

  CVE-2026-44840: Dgraph DQL Injection via checkUserPassword GraphQL Query

  Dgraph's checkUserPassword GraphQL query passes user-supplied passwords directly into a DQL query string, letting an unauthenticated attacker inject arbitrary query blocks and enumerate or probe the…

• highCVE-2026-47424

  CVE-2026-47424: OpenAM Authenticated Groovy Sandbox Escape to RCE

  A flaw in OpenAM's server-side Groovy scripting sandbox lets an authenticated script author run operating-system commands on the host, breaking the only code-level wall between a realm administrator…