GHSA-7m8x-qg2j-4m3v: Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec

June 30, 2026

The Fission MessageQueueTrigger (MQT) scaler controller exposed two privilege-escalation primitives to any subject able to create MQTs in a namespace.

References

github.com/advisories/GHSA-7m8x-qg2j-4m3v
github.com/fission/fission/commit/94bf5792396989fdd71961e8701833c8110da889
github.com/fission/fission/pull/3367
github.com/fission/fission/releases/tag/v1.24.0
github.com/fission/fission/security/advisories/GHSA-7m8x-qg2j-4m3v

Code Behaviors & Features

Detect and mitigate GHSA-7m8x-qg2j-4m3v with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →