https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T15:38:12.626128+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-326789 EUVD-2026-326789 2026-10-07T15:38:12.672884+00:00 EUVD-2026-326789 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46612 fkie_cve-2026-46612 2026-10-07T15:38:12.672925+00:00

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission storagesvc component registers archive CRUD handlers (/v1/archive GET / POST / DELETE and /v1/archives list) directly on its HTTP router without performing any authentication or authorization. Any caller able to reach the storagesvc ClusterIP — including any other workload in the same Kubernetes cluster — could enumerate archive IDs, download archives belonging to other tenants, upload arbitrary archive content, and delete archives. This issue has been patched in version 1.23.0.

 https://cve.radiocsirt.org/vuln/ghsa-chf8-4hv6-8pg6 GHSA-chf8-4hv6-8pg6 — Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives 2026-10-07T15:38:12.672965+00:00

Affected: Go: github.com/fission/fission

### Summary

The Fission `storagesvc` component registers archive CRUD handlers (`/v1/archive` GET / POST / DELETE and `/v1/archives` list) directly on its HTTP router without performing any authentication or authorization. Any caller able to reach the `storagesvc` ClusterIP — including any other workload in the same Kubernetes cluster — could enumerate archive IDs, download archives belonging to other tenants, upload arbitrary archive content, and delete archives.

### Affected component

- `pkg/storagesvc/storagesvc.go` — handler registration and per-route handler logic at lines 72-95 (list), 167-199 (download/delete), and 263-270 (route wiring).

### Impact

A workload elsewhere in the cluster (e.g. a compromised function pod, a noisy-neighbour tenant in a multi-tenant deployment, or any pod whose egress is not constrained by NetworkPolicy) could:

1. Enumerate every function deployment archive in the cluster. 2. Download the deployment archive of any function in any namespace, exposing the function's source code and any embedded secrets. 3. Delete archives, causing the next function specialization or rebuild to fail. 4. Upload arbitrary archives that subsequent function specializations would fetch and execute.

In multi-tenant Fission deployments this completely breaks the tenant boundary for function code.

### Root cause

`pkg/storagesvc/storagesvc.go` mounts the handlers without an authentication middleware. Network-layer controls (`NetworkPolicy`) we…