{"id":"CVE-2026-50569","aliases":["GHSA-vchh-r53j-8mpw"],"title":"Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks","summary":"Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks","severity":"medium","cvss":4.3,"cwe":["CWE-20"],"vendor":"fission","product":"github.com/fission/fission","ecosystem":"go","affected":["github.com/fission/fission <= 1.24.0"],"patched":["github.com/fission/fission 1.25.0"],"published":"2026-07-28","updated":"2026-07-28","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-vchh-r53j-8mpw","references":[{"url":"https://github.com/fission/fission/security/advisories/GHSA-vchh-r53j-8mpw"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50569"},{"url":"https://github.com/fission/fission/pull/3464"},{"url":"https://github.com/fission/fission/commit/0deed6bf3f26bc0f10e9130cd0d479b0b9f5f609"},{"url":"https://github.com/fission/fission/releases/tag/v1.25.0"},{"url":"https://github.com/advisories/GHSA-vchh-r53j-8mpw"}],"tags":["ghsa","go"],"epss":0.00228,"epssPercentile":0.13747,"ingestedAt":"2026-07-28T20:38:51.065Z","slug":"CVE-2026-50569","body":"## Overview\n\n`HTTPTriggerSpec.Validate()` validated `Methods`, `FunctionReference`, `Host`, `IngressConfig`, and `CorsConfig`, but silently skipped `RelativeURL` and `Prefix`. Those two fields were validated at the CLI level only\n(`pkg/fission-cli/cmd/httptrigger/create.go:83`). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via `kubectl apply` or\na direct Kubernetes REST API call bypassed every URL-level check.\n\nA tenant with HTTPTrigger create permission could therefore create triggers whose `RelativeURL` or `Prefix`:\n\n- was empty (with both fields unset, the trigger has no URL),\n- did not start with `/`,\n- was exactly `/` (claiming the entire router root),\n- contained `..` traversal segments (e.g. `/api/../admin`),\n- collided with router-owned routes: `/router-healthz`, `/readyz`, `/_version`, `/auth/login`,\n- collided with the router-internal function prefix `/fission-function/<ns>/<name>`.\n\n### Affected\n\n- Project: `github.com/fission/fission`\n- Versions: all versions through v1.24.0\n- Audited commit: `647c141`\n- Component: `pkg/apis/core/v1/validation.go:HTTPTriggerSpec.Validate` (and the missing CEL on `HTTPTriggerSpec`)\n- Configuration: default\n\nFix section (paste into the Fix / Patches field)\n\nFixed in [v1.25.0](https://github.com/fission/fission/releases/tag/v1.25.0) by:\n\n- [PR #3464](https://github.com/fission/fission/pull/3464) (commit [`0deed6bf`](https://github.com/fission/fission/commit/0deed6bf2af2a0c0c6094b25e1a0afad36773e3b)) — enforce the path-safety invariants at both admission layers so the API\nserver's CEL evaluation and the Go-side `HTTPTriggerSpec.Validate()` agree:\n  - Three `+kubebuilder:validation:XValidation` rules on `HTTPTriggerSpec` (the API server's CEL admission gate, regenerated into `crds/v1/fission.io_httptriggers.yaml`):\n    - at least one of `relativeurl` or `prefix` must be non-empty;\n    - `relativeurl`, when set, must start with `/`, must not be `/`, must contain no `..` segment, must not be in the reserved exact-path set, and must not start with `/fission-function/`;\n    - `prefix`, when set, the same rules guarded by `has(self.prefix)`.\n  - `validateTriggerPath` helper in `pkg/apis/core/v1/validation.go`, invoked from `HTTPTriggerSpec.Validate()`, mirrors the CEL rules so the CLI's early rejection and the router reconciler's status-Condition path match what the API\nserver admits.\n\nRegression coverage: a new `TestHTTPTriggerSpecValidate_Path` table in `pkg/apis/core/v1/validation_validators_test.go` exercises every PoC case from the advisory plus literal `..`-prefixed-segment positives that must remain allowed.\n\n## Affected packages\n\n- `github.com/fission/fission <= 1.24.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/fission/fission 1.25.0`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}