EUVD-2026-36095
GHSA-gc3j-79f2-7vvw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionNVD
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a low-privilege developer who could create a KubernetesWatchTrigger (KWT) in their own namespace was able to establish a persistent surveillance channel over any other namespace. This issue has been patched in version 1.24.0.
Articles & Coverage 1
AnalysisAI
Cross-namespace information disclosure in Fission prior to 1.24.0 allows a low-privilege developer with namespace-scoped permissions to create a KubernetesWatchTrigger (KWT) that establishes a persistent watch channel against Kubernetes resources in any other namespace, breaking the platform's tenancy boundary. The flaw stems from missing namespace-equality enforcement in the kubewatcher controller, which honored an attacker-supplied Spec.Namespace value and even treated an empty value as cluster-wide visibility. No public exploit identified at time of analysis, but the upstream fix (PR #3379, merged into v1.24.0) and detailed advisory GHSA-gc3j-79f2-7vvw confirm the defect class.
Technical ContextAI
Fission is a Kubernetes-native serverless framework (cpe:2.3:a:fission:fission) where KubernetesWatchTrigger CRDs cause the controller to open a client-go watch against the Kubernetes API for Pods, Services, ReplicationControllers, or Jobs. The vulnerable createKubernetesWatch function in pkg/kubewatcher/kubewatcher.go used the user-supplied w.Spec.Namespace directly when invoking kubeClient.CoreV1().Pods(ns).Watch(...), with no check that it matched the trigger's own namespace, and an empty string was passed through to client-go where empty-namespace semantics mean 'watch all namespaces' cluster-wide. This is a classic CWE-284 Improper Access Control failure: the controller, which runs with cluster-level privileges, performed an action on behalf of a namespace-scoped tenant without scoping the request to that tenant's namespace.
RemediationAI
Vendor-released patch: upgrade Fission to version 1.24.0 or later, which adds explicit cross-namespace rejection in pkg/kubewatcher/kubewatcher.go (createKubernetesWatch now returns an error when w.Spec.Namespace differs from the trigger's namespace) and coerces an empty Spec.Namespace to the trigger's own namespace so an unset field can no longer resolve to cluster-wide visibility; release notes are at https://github.com/fission/fission/releases/tag/v1.24.0 and the GHSA advisory is at https://github.com/fission/fission/security/advisories/GHSA-gc3j-79f2-7vvw. If immediate upgrade is not possible, restrict who can create KubernetesWatchTrigger custom resources by tightening RBAC (remove create/update on kubernetes.fission.io watch trigger resources for untrusted developer service accounts and groups) - the trade-off is that legitimate developers lose the ability to register Kubernetes event triggers until they are upgraded. As an additional compensating control, audit existing KubernetesWatchTrigger objects across the cluster for Spec.Namespace values that do not match metadata.namespace (or that are empty) and delete them, since the patch's defence-in-depth comments note that admission webhooks running with failurePolicy=Ignore or stale objects on upgraded clusters can still surface the unsafe configuration.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Kamaji is the Hosted Control Plane Manager for Kubernetes. Rated critical severity (CVSS 9.9), this vulnerability is rem
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, ref
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today