CVE-2026-50566

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a tenant with environments.fission.io create/update RBAC can run privileged / allowPrivilegeEscalation / dangerous-capability containers in the Fission function or builder namespace, scheduled under the executor's high-privilege service account — enabling container-sandbox escape, host filesystem and network access, and potential node- and cluster-level compromise. This issue has been patched in version 1.24.0.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-250 CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-505677.7Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-505683.6Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-505694.3Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-50577.5ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denia CVE-2026-505708.5Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes CVE-2026-505725.9Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's CVE-2026-505738.1pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detect CVE-2026-505749.6yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest CVE-2026-505757.7BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allow CVE-2026-505766.8ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Pri CVE-2026-505777.4ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Pri CVE-2026-505787.5ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Pri