Is CVE-2026-50566 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50566 being exploited in the wild.

How severe is CVE-2026-50566?

Critical severity, with a CVSS score of 9.9, published 10 June 2026.

Which products and versions are affected?

Fission <= 1.23.0; github.com/fission/fission (Go) <= 1.23.0, SEMVER:introduced=0,fixed=1.24.0.

Is there a fix for CVE-2026-50566?

Yes. github.com/fission/fission (Go): upgrade to 1.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50566 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50566?

Check whether you run Fission or github.com/fission/fission (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50566: Fission privilege escalation via Environment Container SecurityContext bypass

Q: Which products and versions are affected?

Fission <= 1.23.0; github.com/fission/fission (Go) <= 1.23.0, SEMVER:introduced=0,fixed=1.24.0.

Q: Is there a fix for CVE-2026-50566?

Yes. github.com/fission/fission (Go): upgrade to 1.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50566 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-50566?

Check whether you run Fission or github.com/fission/fission (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50566 · Severity: critical · CVSS 9.9 · Published 2026-06-10

Fission is a framework for running serverless functions on Kubernetes. A security flaw in how Fission handles environment configurations allows users with basic permissions to bypass safety checks and create highly privileged containers. An attacker could use this to escape the container sandbox, access the underlying host system, and potentially compromise the entire Kubernetes cluster.

Technologies: Fission, github.com/fission/fission (Go). Vendors: Fission, Go.

Quick answers

Is CVE-2026-50566 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50566 being exploited in the wild.
How severe is CVE-2026-50566?: Critical severity, with a CVSS score of 9.9, published 10 June 2026.
Which products and versions are affected?: Fission <= 1.23.0; github.com/fission/fission (Go) <= 1.23.0, SEMVER:introduced=0,fixed=1.24.0.
Is there a fix for CVE-2026-50566?: Yes. github.com/fission/fission (Go): upgrade to 1.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50566 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50566?: Check whether you run Fission or github.com/fission/fission (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/fission/fission (Go): upgrade to 1.24.0 or later
```
go get github.com/fission/fission@v1.24.0
```

Technical details

A privilege escalation vulnerability exists in Fission due to an incomplete fix for previous PodSpec hardening. While Fission validates 'PodSpec' fields, it failed to inspect the standalone 'spec.runtime.container' and 'spec.builder.container' fields in the Environment Custom Resource Definition (CRD). Specifically, the 'Environment.Validate()' function did not call safety checks on these container-level SecurityContexts, and the 'MergeContainer()' function lacked sanitization logic. An attacker with 'environments.fission.io' create/update RBAC can inject 'privileged: true' or dangerous capabilities (e.g., SYS_ADMIN) into these fields. This allows for container escape and host-level access. The issue is fixed in v1.24.0 by adding 'ValidateContainerSafety' to the admission webhook and sanitization to the merge layer.

Affected products

fission fission <= 1.23.0

Identifiers

CVE-2026-50566
GHSA-m63v-2g9w-2w6v
GO-2026-5857

Timeline

2026-05-26: patched: Fix released in v1.24.0
2026-06-10: advisory: NVD published CVE-2026-50566
2026-06-30: disclosed: GitHub Advisory GHSA-m63v-2g9w-2w6v published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.