Executive brief
Fission is an open-source framework for serverless functions on Kubernetes. A security flaw in how it validates container settings allows a malicious user to gain unauthorized control over the system clock of the underlying server. This can disrupt critical security services, invalidate digital certificates, and cause widespread operational failures for all other users sharing the same server infrastructure.
Technical details
Fission v1.24.0 implemented a security validation layer for Environment and Function Custom Resource Definitions (CRDs) using a fixed denylist of dangerous Linux capabilities. However, the denylist omitted CAP_SYS_TIME, SYS_RAWIO, BPF, and others. An attacker with permissions to create or modify Fission Functions can inject CAP_SYS_TIME into the container's securityContext. Because the Linux real-time clock (CLOCK_REALTIME) is not namespaced, a container with this capability can modify the host node's clock, impacting TLS validation, Kubernetes lease renewals, and token expiration across all tenants on that node. The vulnerability is mitigated if the cluster enforces a 'restricted' Pod Security Admission (PSA) profile. Version 1.25.0 fixes this by replacing the denylist with a strict allowlist.
Affected products
- fission fission <= 1.24.0
Timeline
- 2026-06-08: disclosed
- 2026-06-10: advisory: NVD published
- 2026-07-28: patched: GitHub Advisory reviewed and updated with patch details