Fission EUVD-2026-36073

Exploitation requires an authenticated Kubernetes principal with create or update RBAC rights on the httptriggers.fission.io custom resource in the namespace where Fission is deployed - typically a developer, CI/CD pipeline account, or namespace admin. The attacker must bypass the Fission CLI by constructing the HTTPTrigger manifest manually and applying it via kubectl apply or a direct call to the Kubernetes REST API; using the Fission CLI httptrigger create command would trigger the existing CLI-level path validation and block the malformed input. The target cluster must be running Fission prior to version 1.25.0 and must have reached the post-CRD-modernization state where the HTTPTrigger admission webhook was retired. Exploitation is limited in impact to URL routing integrity within the Fission router - no direct path to code execution or data exfiltration is implied. Specific paths that can be injected include those containing .. traversal segments, the exact strings /router-healthz, /readyz, /_version, /auth/login, or any path beginning with /fission-function/.

CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects the limited blast radius: network-reachable, low complexity, but requires low-privileged authenticated access (PR:L) and produces only low integrity impact (I:L) with no confidentiality or availability consequence. EPSS data was not provided in the available intelligence; the score cannot be independently assessed here. The CVE is not listed in CISA KEV and no POC is publicly identified at time of analysis, indicating no confirmed opportunistic or targeted exploitation. Real-world priority is moderate-to-low for most deployments: the attack requires a Kubernetes principal with create rights on Fission HTTPTrigger CRs, which is typically scoped to developers or CI/CD pipelines already trusted to deploy functions. The most impactful abuse scenarios - colliding with /router-healthz or /readyz to shadow health probes, or injecting /fission-function/ prefix routes to shadow internal router paths - could affect routing stability, but achieving arbitrary code execution or data exfiltration via this vulnerability alone is not supported by available data. No CVSS/description conflict identified; AV:N is consistent with exploitation via the Kubernetes API server over the network.

A developer or CI/CD service account with namespace-scoped Kubernetes RBAC permissions to create Fission HTTPTrigger resources crafts a manifest with RelativeURL set to /router-healthz or a path containing /../ traversal segments and applies it directly via kubectl apply -f, bypassing the Fission CLI's path validation entirely. The Kubernetes API server accepts the resource since no CEL rules existed on those fields prior to v1.25.0, and the malicious HTTPTrigger is registered in the Fission router - potentially shadowing the router's own liveness endpoint or routing requests through an unintended function. No public POC is available, but the bypass requires no special tooling beyond standard kubectl access.