CVE-2026-49823
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications. In versions prior to 1.24.0, the Fission Function spec did not validate the namespace for Package reference, which could lead to unauthorized access.
Risk Assessment
The lack of namespace validation for the package reference may allow attackers to access resources in the wrong namespace, posing a security threat to applications.
Recommendation
It is recommended to upgrade to version 1.24.0 or later to mitigate this security vulnerability.
Other vulnerabilities in Fission Framework
See all- CVE-2026-50566Critical
Fission is a serverless framework, native to Kubernetes, that simplifies the deployment of functions and applications. In versions prior to 1.24.0, a user with appropriate RBAC permissions could run privileged containers, leading to container-sandbox escape and access to the host's filesystem and network.
- CVE-2026-46617High
Fission, a serverless framework for Kubernetes, prior to version 1.23.0, created runtime pods with ServiceAccountName: fission-fetcher, which had permissions to read secrets and configmaps across the entire namespace. This allowed user-supplied function code to access the Kubernetes API token, enabling it to read any secrets or configmaps in the function's namespace.
Original NVD description (English source)
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; PackageRef.Namespace was not. This issue has been patched in version 1.24.0.