GHSA-7m8x-qg2j-4m3v: Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec

June 30, 2026

The Fission MessageQueueTrigger (MQT) scaler controller exposed two privilege-escalation primitives to any subject able to create MQTs in a namespace.

References

github.com/advisories/GHSA-7m8x-qg2j-4m3v
github.com/fission/fission/commit/94bf5792396989fdd71961e8701833c8110da889
github.com/fission/fission/pull/3367
github.com/fission/fission/releases/tag/v1.24.0
github.com/fission/fission/security/advisories/GHSA-7m8x-qg2j-4m3v

Code Behaviors & Features

Detect and mitigate GHSA-7m8x-qg2j-4m3v with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →