EUVD-2026-36094

Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the KubernetesWatchTrigger process. An attacker can gain unauthorized access to sensitive events from other namespaces by creating a KubernetesWatchTrigger in their own namespace, enabling persistent surveillan...

Execution with Unnecessary Privileges

Overview Affected versions of this package are vulnerable to Execution with Unnecessary Privileges in the process where builder pods are created without disabling automatic mounting of the service account token. An attacker can gain unauthorized access to the service account token by supplying a...

CVE-2026-49821: Unintended Proxy or Intermediary

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that Package.spec.environment.namespace matched...