{"id":"GHSA-7m8x-qg2j-4m3v","aliases":["GO-2026-5849"],"url":"https://o3.security/vulnerability/GHSA-7m8x-qg2j-4m3v","summary":"Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec","details":"### Summary\n\nThe Fission MessageQueueTrigger (MQT) scaler controller exposed two privilege-escalation primitives to any subject able to create MQTs in a namespace.\n\n### Details\n\n**1. Secret materialization.** `getEnvVarlist` in `pkg/mqtrigger/scalermanager.go` read the Secret named in `Spec.Secret` using the controller's cluster-wide `secrets/get` RBAC and emitted each key as a literal `EnvVar.Value`, copying\nthe plaintext secret content into the connector Deployment's pod template. A subject holding `messagequeuetriggers/create` but **not** `secrets/get` could exfiltrate any Secret in the namespace by pointing an MQT at it.\n\n**2. PodSpec injection.** `Spec.PodSpec` was merged into the controller-built connector PodSpec via `util.MergePodSpec` with no allowlist on which fields could come from the user. An MQT could substitute `Containers[].Image` (run any\nimage), override `Command`/`Args`, inject `Env`, add `VolumeMounts` + `Volumes`, override `ServiceAccountName`, and set `HostNetwork`/`HostPID`/`HostIPC` — turning `messagequeuetriggers/create` into effective `deployments/create` with an\n arbitrary image and service account.\n\n### Impact\n\nA tenant with only `messagequeuetriggers.fission.io/create` in a namespace could read any Secret in that namespace and run an arbitrary container image under an arbitrary service account, escalating well beyond their intended RBAC.\n\n### Fix\n\nFixed in [#3367](https://github.com/fission/fission/pull/3367) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0).\n\n- `getEnvVarlist` now emits `EnvVar.ValueFrom.SecretKeyRef` so the connector pod resolves values at start time under its own service account. The secret values are never written into the Deployment object and never logged.\n- A new allowlist, `MergeAllowedPodSpecFields` (`pkg/executor/util/merge_allowlist.go`), accepts only `NodeSelector`, `Tolerations`, `Affinity`, `RuntimeClassName`, and per-container `Resources`. All other user-supplied fields are\ndropped at the controller layer, and the validating webhook rejects every populated non-allowlisted field with a clear error. The webhook and the merge helper share a single canonical `DisallowedPodSpecFields` enumeration so they cannot\ndrift.\n\n### Behavioural change\n\nMQT authors that previously overrode the connector image, command, args, env, volumes, service account, or host namespaces via `Spec.PodSpec` will see those fields rejected at admission (or silently dropped if the webhook is disabled).\nAllowlisted fields flow through unchanged.","published":"2026-06-30T18:12:48Z","modified":"2026-07-07T16:11:37.592998565Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/fission/fission","fixedVersion":"1.24.0"}],"fix":{"url":"https://github.com/fission/fission/pull/3367","label":"fission/fission#3367"},"references":[{"type":"WEB","url":"https://github.com/fission/fission/security/advisories/GHSA-7m8x-qg2j-4m3v"},{"type":"WEB","url":"https://github.com/fission/fission/pull/3367"},{"type":"WEB","url":"https://github.com/fission/fission/commit/94bf5792396989fdd71961e8701833c8110da889"},{"type":"PACKAGE","url":"https://github.com/fission/fission"},{"type":"WEB","url":"https://github.com/fission/fission/releases/tag/v1.24.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-07T16:11:37.592998565Z"}}