EUVD-2026-36095Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionNVD
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a low-privilege developer who could create a KubernetesWatchTrigger (KWT) in their own namespace was able to establish a persistent surveillance channel over any other namespace. This issue has been patched in version 1.24.0.
Articles & Coverage 1
AnalysisAI
Cross-namespace information disclosure in Fission prior to 1.24.0 allows a low-privilege developer with namespace-scoped permissions to create a KubernetesWatchTrigger (KWT) that establishes a persistent watch channel against Kubernetes resources in any other namespace, breaking the platform's tenancy boundary. The flaw stems from missing namespace-equality enforcement in the kubewatcher controller, which honored an attacker-supplied Spec.Namespace value and even treated an empty value as cluster-wide visibility. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a running Fission deployment prior to v1.24.0 on a shared Kubernetes cluster, plus an attacker identity with namespace-scoped RBAC permission to create KubernetesWatchTrigger custom resources (kubernetes.fission.io) in at least one namespace they control - exactly the privilege a normal Fission application developer holds. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N accurately models the threat: network-reachable Kubernetes API, low complexity, low privileges (any developer who can create a KWT in their own namespace), no user interaction, scope change (the controller's cluster-wide privileges are leveraged), and high confidentiality impact with no integrity or availability effect - consistent with a read-only cross-tenant watch leak. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A developer with create permissions on KubernetesWatchTrigger objects in their own namespace (e.g., team-a) submits a KWT manifest whose spec.namespace points at a victim namespace such as kube-system or finance-prod, or leaves spec.namespace empty to obtain a cluster-wide watch. The Fission kubewatcher controller, running with cluster-level privileges, opens a long-lived client-go watch against Pods, Services, ReplicationControllers, or Jobs in the targeted namespace and streams every add/update/delete event - including pod names, labels, annotations, and environment metadata - back through Fission's function invocation path, giving the attacker a persistent surveillance channel across tenancy boundaries. |
| Remediation | Vendor-released patch: upgrade Fission to version 1.24.0 or later, which adds explicit cross-namespace rejection in pkg/kubewatcher/kubewatcher.go (createKubernetesWatch now returns an error when w.Spec.Namespace differs from the trigger's namespace) and coerces an empty Spec.Namespace to the trigger's own namespace so an unset field can no longer resolve to cluster-wide visibility; release notes are at https://github.com/fission/fission/releases/tag/v1.24.0 and the GHSA advisory is at https://github.com/fission/fission/security/advisories/GHSA-gc3j-79f2-7vvw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all production Fission deployments and document their current version and multi-tenancy status. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Privilege escalation in Fission (Kubernetes-native serverless framework) prior to version 1.24.0 allows a tenant with Fu
Privilege escalation in Fission prior to version 1.24.0 allows a tenant holding environments.fission.io create/update RB
Privilege escalation in Fission prior to 1.24.0 allows an authenticated user with permission to create or modify Environ
Privilege escalation in Fission (Kubernetes-native serverless framework) prior to version 1.24.0 allows a tenant with En
Cross-namespace access control bypass in Fission (Kubernetes-native serverless framework) prior to 1.24.0 allows an auth
Share
External POC / Exploit Code
Leaving vuln.today