CVE-2026-50569

HTTPTriggerSpec.Validate() validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only (pkg/fission-cli/cmd/httptrigger/create.go:83). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via kubectl apply or a direct Kubernetes REST API call bypassed every URL-level check.

A tenant with HTTPTrigger create permission could therefore create triggers whose RelativeURL or Prefix:

• was empty (with both fields unset, the trigger has no URL),
• did not start with /,
• was exactly / (claiming the entire router root),
• contained .. traversal segments (e.g. /api/../admin),
• collided with router-owned routes: /router-healthz, /readyz, /_version, /auth/login,
• collided with the router-internal function prefix /fission-function/<ns>/<name>.

Affected

• Project: github.com/fission/fission
• Versions: all versions through v1.24.0
• Audited commit: 647c141
• Component: pkg/apis/core/v1/validation.go:HTTPTriggerSpec.Validate (and the missing CEL on HTTPTriggerSpec)
• Configuration: default

Fix section (paste into the Fix / Patches field)

Fixed in v1.25.0 by:

• PR #3464 (commit 0deed6bf) — enforce the path-safety invariants at both admission layers so the API server's CEL evaluation and the Go-side HTTPTriggerSpec.Validate() agree:
  • Three +kubebuilder:validation:XValidation rules on HTTPTriggerSpec (the API server's CEL admission gate, regenerated into crds/v1/fission.io_httptriggers.yaml):
    • at least one of relativeurl or prefix must be non-empty;
    • relativeurl, when set, must start with /, must not be /, must contain no .. segment, must not be in the reserved exact-path set, and must not start with /fission-function/;
    • prefix, when set, the same rules guarded by has(self.prefix).
  • validateTriggerPath helper in pkg/apis/core/v1/validation.go, invoked from HTTPTriggerSpec.Validate(), mirrors the CEL rules so the CLI's early rejection and the router reconciler's status-Condition path match what the API server admits.

Regression coverage: a new TestHTTPTriggerSpecValidate_Path table in pkg/apis/core/v1/validation_validators_test.go exercises every PoC case from the advisory plus literal ..-prefixed-segment positives that must remain allowed.