The vulnerability arises from Fission's HTTPTriggerSpec.Validate() missing validation for RelativeURL and Prefix fields. These fields are only checked at the CLI level, and the API server’s modernized webhook and CEL validation rules do not apply. As a result, an attacker can supply arbitrary RelativeURL or Prefix values when creating or updating HTTPTrigger resources via kubectl apply or direct REST API calls. This bypasses URL‑level restrictions, potentially allowing unauthorized function exposure or manipulation, and falls under CWE‑20 (Improper Input Validation).

The flaw affects all Fission releases older than v1.25.0. Users running any version of the fission serverless framework on Kubernetes that includes HTTPTrigger resources are susceptible until the update is applied.

The CVSS score is 4.3, indicating moderate impact. The EPSS score is unavailable, and the vulnerability is not listed in CISA's KEV catalog. An exploit requires permissions to create or modify HTTPTrigger objects, which typically translates to cluster‑level RBAC or component‑level service accounts. Attackers with such privileges could inject arbitrary URLs, potentially exposing internal endpoints or allowing unintended traffic routing. The lack of a public exploit reduces current risk, but the vulnerability remains exploitable until remediated.