EUVD-2026-36098Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Environment.spec.runtime.podSpec / spec.builder.podSpec passthrough lacked validation, and MergePodSpec propagated dangerous fields into the generated pods. This issue has been patched in version 1.24.0.
Articles & Coverage 2
AnalysisAI
Privilege escalation in Fission prior to 1.24.0 allows an authenticated user with permission to create or modify Environment custom resources to abuse unvalidated podSpec passthrough fields (Environment.spec.runtime.podSpec and spec.builder.podSpec), causing MergePodSpec to propagate dangerous fields - notably AutomountServiceAccountToken - into the generated builder/runtime pods. Because the fission-builder ServiceAccount token then becomes accessible from a user-supplied container, an attacker can pivot from a Fission tenant into broader Kubernetes cluster privileges (CVSS 9.9, Scope:Changed). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must hold Kubernetes RBAC permitting create or update on Fission Environment custom resources (environments.fission.io) in at least one namespace where the Fission buildermgr/executor is reconciling - this is the PR:L authenticated prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 9.9 score is driven by Scope:Changed plus full CIA impact, which is consistent with a tenant breaking out of its pod boundary into cluster-wide ServiceAccount privileges - a realistic outcome here given the SA-token exposure documented in the PR diff. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with namespace-level RBAC to create a Fission Environment (for example, a developer in a multi-tenant cluster, or an attacker who has compromised a CI service account) submits an Environment whose spec.builder.podSpec sets AutomountServiceAccountToken=true and points the builder container image at attacker-controlled code. When the buildermgr reconciles the Environment, MergePodSpec propagates the flag, and kubelet mounts the fission-builder ServiceAccount token inside the attacker's builder container; the attacker's container reads the token and calls the Kubernetes API with fission-builder privileges, pivoting toward cluster-wide compromise. … |
| Remediation | Upgrade to Fission v1.24.0 or later (release: https://github.com/fission/fission/releases/tag/v1.24.0), which corresponds to the upstream fix in PRs https://github.com/fission/fission/pull/3390 and https://github.com/fission/fission/pull/3391 - these explicitly set AutomountServiceAccountToken=false on the pod, re-clamp it after MergePodSpec runs, and re-mount the fission-builder SA token only on the fetcher sidecar via a projected volume. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Fission deployments, confirm current versions, and audit which users and service accounts hold permission to create or modify Environment resources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Privilege escalation in Fission (Kubernetes-native serverless framework) prior to version 1.24.0 allows a tenant with Fu
Privilege escalation in Fission prior to version 1.24.0 allows a tenant holding environments.fission.io create/update RB
Privilege escalation in Fission (Kubernetes-native serverless framework) prior to version 1.24.0 allows a tenant with En
Cross-namespace access control bypass in Fission (Kubernetes-native serverless framework) prior to 1.24.0 allows an auth
Privilege escalation in Fission (Kubernetes-native serverless framework) prior to version 1.25.0 allows a tenant with pe
Share
External POC / Exploit Code
Leaving vuln.today