EUVD-2026-36094
GHSA-vjhc-cf4p-72q4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionNVD
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that Package.spec.environment.namespace matched Package.metadata.namespace. This issue has been patched in version 1.24.0.
Articles & Coverage 1
AnalysisAI
Cross-namespace package reference flaw in Fission prior to version 1.24.0 allows an authenticated tenant to point a Package CRD at an Environment in another namespace, because the buildermgr controller never verified that Package.spec.environment.namespace matched Package.metadata.namespace. With CVSS 7.7 and a scope-changed confidentiality impact, a low-privileged user in one namespace can cause the controller to read and build against environment resources belonging to other tenants. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Fission (cpe:2.3:a:fission:fission) is a Kubernetes-native serverless framework where Package CRDs reference Environment CRDs that define the build/runtime image. The buildermgr controller and its pkgwatcher reconcile Package objects and trigger builds; prior to 1.24.0 it trusted whatever namespace was set in Package.spec.environment.namespace without enforcing co-location with the Package's own namespace. This is a classic CWE-441 (Unintended Proxy or Intermediary / Confused Deputy) - the controller acts with cluster-wide privilege on behalf of a tenant-scoped object, so a low-privileged tenant can induce the controller to access resources across the namespace boundary. The PR 3379 fix adds explicit equality checks in both pkg/buildermgr/common.go and pkg/buildermgr/pkgwatcher.go, and the same patch also hardens kubewatcher against an analogous cross-namespace watch issue (GHSA-gc3j-79f2-7vvw), including coercing an empty Spec.Namespace away from client-go's cluster-wide semantics.
RemediationAI
Vendor-released patch: upgrade Fission to version 1.24.0 or later (https://github.com/fission/fission/releases/tag/v1.24.0), which adds explicit namespace-equality checks in buildermgr/common.go and buildermgr/pkgwatcher.go and also hardens kubewatcher against an analogous cross-namespace issue per PR https://github.com/fission/fission/pull/3379. If immediate upgrade is not possible, ensure the Fission admission webhook is deployed and running with failurePolicy=Fail (not Ignore) so cross-namespace Environment references are rejected at submit time - accepting the trade-off that webhook outages will block Package submissions; additionally, restrict who can create or update Package CRDs via Kubernetes RBAC so only trusted controllers/users in each tenant namespace can submit them, and audit any existing Package objects for spec.environment.namespace values that do not match metadata.namespace and delete them before upgrade. See vendor advisory https://github.com/fission/fission/security/advisories/GHSA-vjhc-cf4p-72q4 for full details.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Kamaji is the Hosted Control Plane Manager for Kubernetes. Rated critical severity (CVSS 9.9), this vulnerability is rem
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, ref
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today