Fission, a Kubernetes-native serverless platform, performed PodSpec validation to restrict capabilities for tenant‑created Functions and Environments, but the denylist omitted CAP_SYS_TIME. An attacker with tenant permissions could specify this capability, bypass admission validation, and run code within a container that gains the ability to set the node’s system clock. This privilege escalation can lead to altered timestamps, misleading logs, and potential denial of service or other time‑dependent attacks.

The vulnerability affects all released versions of Fission prior to 1.25.0, where the admission webhook and sanitization layer were active. The fix is contained in version 1.25.0 and later.

The CVSS score of 8.5 signals a high severity issue. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the exploit path is clear: a tenant can create an Environment or Function with the malicious capability. As long as the tenant has write access to CRDs, the attacker can trigger the vulnerability locally on the cluster node, making it a significant risk in multi‑tenant environments.