Detections
Analytics

SCA: security update for github.com/fission/fission (GHSA-vchh-r53j-8mpw)

medium Tenable Self-Hosted Container Security Plugin ID 445441

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of
 functions and applications on Kubernetes. Prior to version 1.25.0, HTTPTriggerSpec.Validate() validated
 Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and
 Prefix. Those two fields were validated at the CLI level only (pkg/fission-
 cli/cmd/httptrigger/create.go:83). The post-CRD-modernization webhook for HTTPTrigger was retired in favor
 of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via kubectl
 apply or a direct Kubernetes REST API call bypassed every URL-level check. This issue has been patched in
 version 1.25.0. (CVE-2026-50569)

Solution

Update the github.com/fission/fission library and its related packages to version 1.25.0 or later.

See Also

https://github.com/advisories/GHSA-vchh-r53j-8mpw

Plugin Details

Severity: Medium

ID: 445441

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 7/29/2026

Updated: 7/29/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS Score Source: CVE-2026-50569

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/28/2026

Vulnerability Publication Date: 6/10/2026

Reference Information

CVE: CVE-2026-50569

cwe: CWE-20