EUVD-2026-36097
GHSA-cvw6-gfvv-953q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
3DescriptionNVD
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Fission Function admission webhook (pkg/webhook/function.go) validated that spec.secrets[].namespace and spec.configmaps[].namespace equalled the function's own namespace but performed no equivalent check on spec.environment.namespace. This issue has been patched in version 1.24.0.
Articles & Coverage 1
AnalysisAI
Cross-namespace access control bypass in Fission (Kubernetes-native serverless framework) prior to 1.24.0 allows an authenticated tenant with permission to create Function objects in their own namespace to reference an Environment in a different namespace, because the admission webhook in pkg/webhook/function.go validated namespace equality only for secrets and configmaps, not for spec.environment.namespace. An attacker can pivot across Kubernetes namespace boundaries and pull in environment configuration belonging to other tenants (CVSS 8.5, scope-changed, high confidentiality impact). No public exploit identified at time of analysis, though the upstream fix and full patch diff are publicly available on GitHub.
Technical ContextAI
Fission is a Kubernetes-native FaaS platform where Function custom resources reference an Environment (the runtime image/pod template) and a Package (the user code). Namespace separation is the standard Kubernetes multi-tenancy boundary, and Fission enforces it through a validating admission webhook. The root cause is CWE-284 (Improper Access Control): the Validate() function in pkg/webhook/function.go checked that spec.secrets[].namespace and spec.configmaps[].namespace matched the Function's own namespace, but the equivalent check for spec.environment.namespace was simply missing. The upstream patch (PR #3389) adds the missing equality check at the webhook layer and adds defence-in-depth equivalents inside the newdeploy and poolmgr executors (newdeploymgr.go and gpm.go) to catch stale Function objects that bypass the webhook during upgrade windows or when failurePolicy=ignore. CPE cpe:2.3:a:fission:fission:*:*:*:*:*:*:*:* covers all Fission versions prior to 1.24.0.
RemediationAI
Vendor-released patch: upgrade Fission to version 1.24.0 or later (https://github.com/fission/fission/releases/tag/v1.24.0), which adds the missing cross-namespace check for spec.environment.namespace in pkg/webhook/function.go and defence-in-depth checks in the newdeploy and poolmgr executors so that stale Function objects created before the webhook was active are still rejected. Until the upgrade can be performed, restrict who holds create/update rights on fission.io Function resources via Kubernetes RBAC so that only trusted tenants can submit Function specs, and verify that the Fission validating admission webhook is installed with failurePolicy=Fail (not Ignore) so requests are rejected if the webhook is unreachable - note that Fail mode trades availability for safety and will block Function changes during a webhook outage. As an additional compensating control, audit existing Function objects across namespaces for spec.environment.namespace values that differ from the Function's own metadata.namespace and delete or reconcile any that are detected, since the patched executor paths will refuse to serve them after upgrade.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Kamaji is the Hosted Control Plane Manager for Kubernetes. Rated critical severity (CVSS 9.9), this vulnerability is rem
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, ref
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today