Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuardView on GitHub
Search

GHSA-vchh-r53j-8mpw

MediumCVSS 4.3 / 10
Published Jul 28, 2026·Last modified Jul 28, 2026
Affected Components(0)

No affected components available

Description

HTTPTriggerSpec.Validate() validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only (pkg/fission-cli/cmd/httptrigger/create.go:83). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via kubectl apply or a direct Kubernetes REST API call bypassed every URL-level check.

A tenant with HTTPTrigger create permission could therefore create triggers whose RelativeURL or Prefix:

  • was empty (with both fields unset, the trigger has no URL),
  • did not start with /,
  • was exactly / (claiming the entire router root),
  • contained .. traversal segments (e.g. /api/../admin),
  • collided with router-owned routes: /router-healthz, /readyz, /_version, /auth/login,
  • collided with the router-internal function prefix /fission-function/<ns>/<name>.

Affected

  • Project: github.com/fission/fission
  • Versions: all versions through v1.24.0
  • Audited commit: 647c141
  • Component: pkg/apis/core/v1/validation.go:HTTPTriggerSpec.Validate (and the missing CEL on HTTPTriggerSpec)
  • Configuration: default

Fix section (paste into the Fix / Patches field)

Fixed in v1.25.0 by:

  • PR #3464 (commit 0deed6bf) — enforce the path-safety invariants at both admission layers so the API server's CEL evaluation and the Go-side HTTPTriggerSpec.Validate() agree:
    • Three +kubebuilder:validation:XValidation rules on HTTPTriggerSpec (the API server's CEL admission gate, regenerated into crds/v1/fission.io_httptriggers.yaml):
      • at least one of relativeurl or prefix must be non-empty;
      • relativeurl, when set, must start with /, must not be /, must contain no .. segment, must not be in the reserved exact-path set, and must not start with /fission-function/;
      • prefix, when set, the same rules guarded by has(self.prefix).
    • validateTriggerPath helper in pkg/apis/core/v1/validation.go, invoked from HTTPTriggerSpec.Validate(), mirrors the CEL rules so the CLI's early rejection and the router reconciler's status-Condition path match what the API server admits.

Regression coverage: a new TestHTTPTriggerSpecValidate_Path table in pkg/apis/core/v1/validation_validators_test.go exercises every PoC case from the advisory plus literal ..-prefixed-segment positives that must remain allowed.

Risk Scores
Base Score
4.3

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a low impact on the integrity of the data.

Threat Intelligence
4.0

Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.

EPSS
0.23%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Browse More

Medium severity
Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard