CVE-2026-49822
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications. Prior to version 1.24.0, a low-privilege developer could create a KubernetesWatchTrigger (KWT) in their own namespace, allowing for a persistent surveillance channel over any other namespace.
Risk Assessment
Organizations may be exposed to unauthorized access to data in other namespaces, potentially leading to information leaks or privacy violations.
Recommendation
It is recommended to upgrade to version 1.24.0 or later to mitigate this vulnerability and to restrict developer permissions for creating KWTs in other namespaces.
Other vulnerabilities in Fission
See all- CVE-2026-50545Critical
Fission is a serverless framework, native to Kubernetes, that simplifies the deployment of functions and applications. Prior to version 1.24.0, the lack of validation in Environment.spec.runtime.podSpec / spec.builder.podSpec led to the propagation of dangerous fields into generated pods.
- CVE-2026-50570High
Fission is a serverless framework, native to Kubernetes, which prior to version 1.25.0 had a vulnerability in PodSpec safety validation for Environment and Function CRDs. This vulnerability allowed the addition of the unauthorized capability CAP_SYS_TIME, enabling the execution of attacker-controlled code.
- CVE-2026-50569Medium
Fission is a serverless framework, native to Kubernetes, that prior to version 1.25.0 improperly validated the RelativeURL and Prefix fields in HTTPTriggerSpec.Validate(). These fields were only validated at the CLI level, allowing URL checks to be bypassed using kubectl or direct Kubernetes REST API calls.
- CVE-2026-50567High
Fission is a Kubernetes-native serverless framework that prior to version 1.25.0 had a vulnerability in the Unarchive function, allowing attackers to write files to unauthorized locations. By manipulating archive names, an attacker could save files in other users' directories or in secret/config volumes.
- CVE-2026-50565Medium
Fission, a Kubernetes-native serverless framework, prior to version 1.24.0, created builder pods with auto-mounted service account tokens, potentially leading to unauthorized access to resources. This issue has been patched in version 1.24.0.
- CVE-2026-49821High
Fission is a serverless framework, native to Kubernetes, that simplifies the deployment of functions and applications. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that the namespace in Package.spec.environment matched the namespace in Package.metadata.
- CVE-2026-46618Medium
Fission is a serverless framework, Kubernetes-native, that prior to version 1.23.0 had a security vulnerability. In pkg/builder/builder.go, the Environment.spec.builder.command was passed without validation, allowing arbitrary code execution in the builder pod context.
Original NVD description (English source)
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a low-privilege developer who could create a KubernetesWatchTrigger (KWT) in their own namespace was able to establish a persistent surveillance channel over any other namespace. This issue has been patched in version 1.24.0.