EUVD-2026-36096Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionNVD
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a Fission Function spec carries three reference types - Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; PackageRef.Namespace was not. This issue has been patched in version 1.24.0.
Articles & Coverage 1
AnalysisAI
Cross-namespace access control bypass in Fission prior to 1.24.0 allows an authenticated tenant to reference Package objects belonging to other Kubernetes namespaces because the admission webhook validated namespaces for Secret and ConfigMap references but omitted the equivalent check for PackageRef.Namespace. A low-privileged user with rights to create Function objects in their own namespace can therefore reach Package contents in arbitrary namespaces, producing a scope-changing confidentiality breach (CVSS 7.7, S:C, C:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Kubernetes principal with permission to create or update Fission Function custom resources in at least one namespace on a cluster running Fission prior to 1.24.0 where the Fission admission webhook is active (the webhook is the vulnerable surface - clusters running with admission webhook failurePolicy=Ignore are also exposed via the executor path until 1.24.0's defense-in-depth checks land). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) accurately portrays a network-reachable, low-complexity, authenticated, scope-changing read primitive: a tenant with namespace-scoped Function-create rights can exfiltrate Package contents from any namespace, which in multi-tenant Kubernetes clusters can include proprietary function code or build artifacts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained credentials for a low-privileged service account in tenant namespace 'ns-attacker' submits a Function spec whose Spec.Package.PackageRef points to {Name: 'private-pkg', Namespace: 'ns-victim'}; the pre-1.24.0 admission webhook accepts the object because it never compared the PackageRef namespace to the Function namespace. When the Fission executor instantiates the function, it resolves the referenced Package using controller-level permissions and exposes its contents to the attacker's invocation path, leaking proprietary code or embedded artifacts from a namespace the attacker has no direct RBAC on. … |
| Remediation | Vendor-released patch: upgrade Fission to v1.24.0 or later (https://github.com/fission/fission/releases/tag/v1.24.0), which adds the missing PackageRef.Namespace check inside the admission webhook (pkg/webhook/function.go) and mirrored defense-in-depth checks in the newdeploy and poolmgr executors. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and document all Fission deployments and their versions in production. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Privilege escalation in Fission (Kubernetes-native serverless framework) prior to version 1.24.0 allows a tenant with Fu
Privilege escalation in Fission prior to version 1.24.0 allows a tenant holding environments.fission.io create/update RB
Privilege escalation in Fission prior to 1.24.0 allows an authenticated user with permission to create or modify Environ
Privilege escalation in Fission (Kubernetes-native serverless framework) prior to version 1.24.0 allows a tenant with En
Cross-namespace access control bypass in Fission (Kubernetes-native serverless framework) prior to 1.24.0 allows an auth
Share
External POC / Exploit Code
Leaving vuln.today