GHSA-7M8X-QG2J-4M3V is a high-severity improper privilege management vulnerability in github.com/fission/fission (go), affecting versions <= 1.23.0. It is fixed in 1.24.0.
Summary The Fission MessageQueueTrigger (MQT) scaler controller exposed two privilege-escalation primitives to any subject able to create MQTs in a namespace. Details Secret materialization. getEnvVarlist in pkg/mqtrigger/scalermanager.go read the Secret named in Spec.Secret using the controller's cluster-wide secrets/get RBAC and emitted each key as a literal EnvVar.Value, copying the plaintext secret content into the connector Deployment's pod template. A subject holding messagequeuetriggers/create but not secrets/get could exfiltrate any Secret in the namespace by pointing an MQT at it. PodSpec injection. Spec.PodSpec was merged into the controller-built connector PodSpec via util.MergePodSpec with no allowlist on which fields could come from the user. An MQT could substitute Containers[].Image (run any image), override Command/Args, inject Env, add VolumeMounts + Volumes, override ServiceAccountName, and set HostNetwork/HostPID/HostIPC, turning messagequeuetriggers/create into effective deployments/create with an arbitrary image and service account. Impact A tenant with only messagequeuetriggers.fission.io/create in a namespace could read any Secret in that namespace and run an arbitrary container image under an arbitrary service account, escalating well beyond their intended RBAC. Fix Fixed in #3367 and released in v1.24.0. getEnvVarlist now emits EnvVar.ValueFrom.SecretKeyRef so the connector pod resolves values at start time under its own service account. The secret values are never written into the Deployment object and never logged. A new allowlist, MergeAllowedPodSpecFields (pkg/executor/util/merge_allowlist.go), accepts only NodeSelector, Tolerations, Affinity, RuntimeClassName, and per-container Resources. All other user-supplied fields are dropped at the controller layer, and the validating webhook rejects every populated non-allowlisted field with a clear error. The webhook and the merge helper share a single canonical DisallowedPodSpecFields enumeration so they cannot drift. Behavioural change MQT authors that previously overrode the connector image, command, args, env, volumes, service account, or host namespaces via Spec.PodSpec will see those fields rejected at admission (or silently dropped if the webhook is disabled). Allowlisted fields flow through unchanged.
The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access. Typical impact: privilege escalation beyond the intended level.
GHSA-7M8X-QG2J-4M3V has a CVSS score of 8.1 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment.
A fixed version is available (1.24.0). Upgrading removes the vulnerable code path.
go
github.com/fission/fission (<= 1.23.0)github.com/fission/fission → 1.24.0 (go)Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter instead of chasing every advisory.
Kodem's runtime-powered SCA identifies whether GHSA-7M8X-QG2J-4M3V is reachable in your applications. Explore open-source security for your team.
See if GHSA-7M8X-QG2J-4M3V is reachable in your applications. Get a demo
Already deployed Kodem? See GHSA-7M8X-QG2J-4M3V in your environment →Upgrade github.com/fission/fission to 1.24.0 or later to resolve this vulnerability.
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
GHSA-7M8X-QG2J-4M3V is a high-severity improper privilege management vulnerability in github.com/fission/fission (go), affecting versions <= 1.23.0. It is fixed in 1.24.0. The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access.
GHSA-7M8X-QG2J-4M3V has a CVSS score of 8.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
github.com/fission/fission (go) versions <= 1.23.0 is affected.
Yes. GHSA-7M8X-QG2J-4M3V is fixed in 1.24.0. Upgrade to this version or later.
Whether GHSA-7M8X-QG2J-4M3V is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
Upgrade github.com/fission/fission to 1.24.0 or later.