| Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escapeCVE-2026-50568 · GHSA-R5JH-Q2MW-GCX4Version ranges need review. |
github.com/fission/fission |
Go |
Low
|
Fix reported |
|
| Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directoryCVE-2026-50567 · GHSA-Q6VM-XQC9-V3FFVersion ranges need review. |
github.com/fission/fission |
Go |
High
|
Fix reported |
|
| Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruptionCVE-2026-50570 · GHSA-QF5V-M7P4-95RPVersion ranges need review. |
github.com/fission/fission |
Go |
High
|
Fix reported |
|
| Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checksCVE-2026-50569 · GHSA-VCHH-R53J-8MPWVersion ranges need review. |
github.com/fission/fission |
Go |
Medium
|
Fix reported |
|
| Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archivesCVE-2026-46612 · GHSA-CHF8-4HV6-8PG6Version ranges need review. |
github.com/fission/fission |
Go |
High
|
Fix reported |
|
| Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap readCVE-2026-46617 · GHSA-85G2-PMRX-R49QVersion ranges need review. |
github.com/fission/fission |
Go |
High
|
Fix reported |
|
| Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpecGHSA-7M8X-QG2J-4M3V · GO-2026-5849Version ranges need review. |
github.com/fission/fission |
Go |
High
|
Fix reported |
|
| Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillanceCVE-2026-49822 · GHSA-GC3J-79F2-7VVWVersion ranges need review. |
github.com/fission/fission |
Go |
High
|
Fix reported |
|
| Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder containerCVE-2026-50565 · GHSA-8WCJ-MFRC-JX5QVersion ranges need review. |
github.com/fission/fission |
Go |
Medium
|
Fix reported |
|
| Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster TakeoverCVE-2026-50545 · GHSA-WMGG-3P4H-48X7Version ranges need review. |
github.com/fission/fission |
Go |
Critical
|
Fix reported |
|
| Fission Container Executor Function PodSpec Injection Leading to Node EscapeCVE-2026-50563 · GHSA-V455-MV2V-5G92Version ranges need review. |
github.com/fission/fission |
Go |
Critical
|
Fix reported |
|
| Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escapeCVE-2026-50564 · GHSA-GX55-F84R-V3R7Version ranges need review. |
github.com/fission/fission |
Go |
Critical
|
Fix reported |
|
| Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhookCVE-2026-49823 · GHSA-3R8V-2XMJ-5C39Version ranges need review. |
github.com/fission/fission |
Go |
High
|
Fix reported |
|
| Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltrationCVE-2026-49821 · GHSA-VJHC-CF4P-72Q4Version ranges need review. |
github.com/fission/fission |
Go |
High
|
Fix reported |
|
| Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creationCVE-2026-50566 · GHSA-M63V-2G9W-2W6VVersion ranges need review. |
github.com/fission/fission |
Go |
Critical
|
Fix reported |
|
| Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhookCVE-2026-49824 · GHSA-CVW6-GFVV-953QVersion ranges need review. |
github.com/fission/fission |
Go |
High
|
Fix reported |
|
| Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executablesCVE-2026-46618 · GHSA-7PJR-QPVH-M339Version ranges need review. |
github.com/fission/fission |
Go |
Medium
|
Fix reported |
|
| Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTriggerCVE-2026-46614 · GHSA-3G33-6VG6-27M8Version ranges need review. |
github.com/fission/fission |
Go |
Critical
|
Fix reported |
|
