CVE-2026-49821
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Fission is a serverless framework, native to Kubernetes, that simplifies the deployment of functions and applications. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that the namespace in Package.spec.environment matched the namespace in Package.metadata.
Risk Assessment
The lack of namespace verification may lead to unauthorized access or improper application behavior in the Kubernetes environment, posing a security risk to the organization.
Recommendation
It is recommended to upgrade Fission to version 1.24.0 or later to mitigate this vulnerability.
Other vulnerabilities in Fission
See all- CVE-2026-50545Critical
Fission is a serverless framework, native to Kubernetes, that simplifies the deployment of functions and applications. Prior to version 1.24.0, the lack of validation in Environment.spec.runtime.podSpec / spec.builder.podSpec led to the propagation of dangerous fields into generated pods.
- CVE-2026-50570High
Fission is a serverless framework, native to Kubernetes, which prior to version 1.25.0 had a vulnerability in PodSpec safety validation for Environment and Function CRDs. This vulnerability allowed the addition of the unauthorized capability CAP_SYS_TIME, enabling the execution of attacker-controlled code.
- CVE-2026-50569Medium
Fission is a serverless framework, native to Kubernetes, that prior to version 1.25.0 improperly validated the RelativeURL and Prefix fields in HTTPTriggerSpec.Validate(). These fields were only validated at the CLI level, allowing URL checks to be bypassed using kubectl or direct Kubernetes REST API calls.
- CVE-2026-50567High
Fission is a Kubernetes-native serverless framework that prior to version 1.25.0 had a vulnerability in the Unarchive function, allowing attackers to write files to unauthorized locations. By manipulating archive names, an attacker could save files in other users' directories or in secret/config volumes.
- CVE-2026-50565Medium
Fission, a Kubernetes-native serverless framework, prior to version 1.24.0, created builder pods with auto-mounted service account tokens, potentially leading to unauthorized access to resources. This issue has been patched in version 1.24.0.
- CVE-2026-49822High
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications. Prior to version 1.24.0, a low-privilege developer could create a KubernetesWatchTrigger (KWT) in their own namespace, allowing for a persistent surveillance channel over any other namespace.
- CVE-2026-46618Medium
Fission is a serverless framework, Kubernetes-native, that prior to version 1.23.0 had a security vulnerability. In pkg/builder/builder.go, the Environment.spec.builder.command was passed without validation, allowing arbitrary code execution in the builder pod context.
Original NVD description (English source)
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that Package.spec.environment.namespace matched Package.metadata.namespace. This issue has been patched in version 1.24.0.