CVE-2026-50545
Published: 10 June 2026
Summary
CVE-2026-50545 is a critical-severity Improper Privilege Management (CWE-269) vulnerability. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 21.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-36098
Vulnerability details
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Environment.spec.runtime.podSpec / spec.builder.podSpec passthrough lacked validation, and MergePodSpec propagated dangerous fields into the generated pods. This issue has…
more
been patched in version 1.24.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing podSpec validation enables injection of privileged fields, directly facilitating privilege escalation and container-to-host escape in Kubernetes.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Provides a tamperproof, always-invoked, and verifiable mechanism to enforce access control policies.
The awareness and training policy mandates training on access control practices, directly reducing the likelihood of improper access control weaknesses being introduced or exploited.
Certification requires independent assessment confirming access controls are implemented correctly and effective.
Reviewing changes for security impacts prevents introduction of improper privilege assignments or escalations.
Tailoring selects and adjusts the precise set of access-control baselines and compensating controls required for the system, directly reducing improper access control exposure.
The documented concept of operations forces organizations to specify how privileges will be assigned, used, and reviewed, directly limiting improper privilege management in day-to-day operations.
Central management enforces consistent access-control policies across systems, reducing the likelihood of missing or inconsistent enforcement.
Dedicated senior leadership with resources directly enables consistent organization-wide privilege management and enforcement of least privilege.