Cyber Resilience

CVE-2026-50564

Critical

Published: 10 June 2026

Published
10 June 2026
Modified
17 June 2026
KEV Added
Patch
CVSS Score v3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0027 19.2th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-50564 is a critical-severity Improper Privilege Management (CWE-269) vulnerability. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 19.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Environment CRD exposes spec.runtime.podSpec and spec.builder.podSpec, which are merged into the Kubernetes pod specs for runtime and builder…

more

pods. The merge logic propagated hostNetwork, hostPID, hostIPC, container privileged, and serviceAccountName from the user-supplied podspec with no filtering, and Environment.Validate performed no security-relevant checks on these fields. This issue has been patched in version 1.24.0.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1611 Escape to Host Privilege Escalation
Adversaries may break out of a container or virtualized environment to gain access to the underlying host.
Why these techniques?

Unfiltered podSpec fields (privileged, hostNetwork/PID/IPC, serviceAccountName) directly enable container escape to host and privilege escalation in Kubernetes workloads.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

Provides a tamperproof, always-invoked, and verifiable mechanism to enforce access control policies.

The awareness and training policy mandates training on access control practices, directly reducing the likelihood of improper access control weaknesses being introduced or exploited.

Certification requires independent assessment confirming access controls are implemented correctly and effective.

Reviewing changes for security impacts prevents introduction of improper privilege assignments or escalations.

Tailoring selects and adjusts the precise set of access-control baselines and compensating controls required for the system, directly reducing improper access control exposure.

The documented concept of operations forces organizations to specify how privileges will be assigned, used, and reviewed, directly limiting improper privilege management in day-to-day operations.

Central management enforces consistent access-control policies across systems, reducing the likelihood of missing or inconsistent enforcement.

Dedicated senior leadership with resources directly enables consistent organization-wide privilege management and enforcement of least privilege.

References