Executive brief
Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec in github.com/fission/fission
Affected products
- Go github.com/fission/fission
Junglewise Threat Intelligence
GO-2026-5849 - Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec in github.
Severity: info · Published 2026-07-07
Technologies: github.com/fission/fission (Go). Vendors: Go.
Related threats
- Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec
- Fission privilege escalation in MessageQueueTrigger scaler manager
- Fission incomplete capability denylist in Environment and Function CRDs
- Fission HTTPTrigger improper input validation in RelativeURL and Prefix
- Fission path traversal in SanitizeFilePath utility