CVE-2026-49821CWE-441CWE-862

Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration

High · published June 10, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that Package.spec.environment.namespace matched Package.metadata.namespace. This issue has been patched in version 1.24.0.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00402 · 33.3th percentile
Weaknesses
CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy'); CWE-862 · Missing Authorization
Published
2026-06-10T17:21Z
EPSS history
Timeline
  • 10 JUN 17:21Z
    Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration
    cvelistv5