CVE-2026-50569: Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

Vulnerability summary

CVE-2026-50569 is a medium (CVSS 4.3) Improper Input Validation vulnerability in fission. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.9% of scored vulnerabilities.

Timeline

1. 10-06-2026
   PublishedVulnerability first disclosed.
2. 10-06-2026
   Last modifiedVulnerability information updated.

Description

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, HTTPTriggerSpec.Validate() validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only (pkg/fission-cli/cmd/httptrigger/create.go:83). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via kubectl apply or a direct Kubernetes REST API call bypassed every URL-level check. This issue has been patched in version 1.25.0.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.