GO-2026-5846 Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook in github.com/fission/fission

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook in github.com/fission/fission...

GO-2026-5852 Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook in github.com/fission/fission

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook in github.com/fission/fission...

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook

Summary The Fission Function admission webhook pkg/webhook/function.go validated that spec.secrets.namespace and spec.configmaps.namespace equalled the function's own namespace but performed no equivalent check on spec.environment.namespace. Details An attacker with permission to create Functions...

GHSA-3R8V-2XMJ-5C39 Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook

Summary A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; PackageRef.Namespace was not. Details A tenant with functions.fission.io/create in their own namespace could set...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the Function admission webhook due to lack of namespace validation for the PackageRef.Namespace field. An attacker can access package data from other namespaces by submitting a crafted function specification...

CVE-2026-49824

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Fission Function admission webhook pkg/webhook/function.go validated that spec.secrets.namespace and spec.configmaps.namespace...

CVE-2026-49824

Fission (Kubernetes-native serverless framework) prior to v1.24.0 allowed a cross-namespace environment reference via the Function admission webhook because spec.environment.namespace was not validated, unlike spec.secrets[].namespace and spec.configmaps[].namespace. The issue affects the Functio...

CVE-2026-49823 Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by...

CVE-2026-49824: Improper Access Control

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Fission Function admission webhook pkg/webhook/function.go validated that spec.secrets.namespace and spec.configmaps.namespace...