CVE-2026-46617 Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read

🗓️ 10 Jun 2026 17:20:10Reported by GoogleType

osv🔗 osv.dev👁 2 Views

CVE-2026-46617: Fission runtime pods automount the token, allowing namespace-wide secret and configmap reads; fixed in version 1.23.0.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-46617	10 Jun 202619:12	–	circl
CNNVD	Fission 安全漏洞	10 Jun 202600:00	–	cnnvd
CVE	CVE-2026-46617	10 Jun 202617:20	–	cve
Cvelist	CVE-2026-46617 Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read	10 Jun 202617:20	–	cvelist
EUVD	EUVD-2026-36092	10 Jun 202617:20	–	euvd
Github Security Blog	Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read	21 May 202620:16	–	github
NVD	CVE-2026-46617	10 Jun 202618:17	–	nvd
OSV	GHSA-85G2-PMRX-R49Q Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read	21 May 202620:16	–	osv
OSV	GO-2026-5241 Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read in github.com/fission/fission	25 Jun 202618:43	–	osv
Positive Technologies	PT-2026-42687	21 May 202600:00	–	ptsecurity

Source	Link
github	www.github.com/fission/fission/releases/tag/v1.23.0
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46617.json
github	www.github.com/fission/fission/security/advisories/GHSA-85g2-pmrx-r49q
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-46617
github	www.github.com/fission/fission/pull/3366

08 Jul 2026 08:13Current

6Medium risk

Vulners AI Score6

CVSS 48.7

EPSS0.00276