Fission vulnerabilities

Products

• Fission 17

Newest

• fission Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption CVE-2026-50570 Fix available 8.5 HighJune 10, 2026
• fission Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks CVE-2026-50569 Fix available 4.3 MediumJune 10, 2026
• fission Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape CVE-2026-50568 Fix available 3.6 LowJune 10, 2026
• fission Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory CVE-2026-50567 Fix available 7.7 HighJune 10, 2026
• fission Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation CVE-2026-50566 Fix available 9.9 CriticalJune 10, 2026
• fission Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container CVE-2026-50565 Fix available 4.9 MediumJune 10, 2026
• fission Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape CVE-2026-50564 Fix available 9.9 CriticalJune 10, 2026
• fission Fission Container Executor Function PodSpec Injection Leading to Node Escape CVE-2026-50563 Fix available 9.9 CriticalJune 10, 2026
• fission Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover CVE-2026-50545 Fix available 9.9 CriticalJune 10, 2026
• fission Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook CVE-2026-49824 Fix available 8.5 HighJune 10, 2026
• fission Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook CVE-2026-49823 Fix available 7.7 HighJune 10, 2026
• fission Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance CVE-2026-49822 Fix available 7.7 HighJune 10, 2026
• fission Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration CVE-2026-49821 Fix available 7.7 HighJune 10, 2026
• fission Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables CVE-2026-46618 Fix available 6.9 MediumMay 21, 2026
• fission Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read CVE-2026-46617 Fix available 8.7 HighMay 21, 2026
• fission Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger CVE-2026-46614 Fix available 9.8 CriticalMay 21, 2026
• fission Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives CVE-2026-46612 Fix available 8.8 HighMay 21, 2026