https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T06:24:57.072056+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-326505 EUVD-2026-326505 2026-10-06T06:24:57.134521+00:00 EUVD-2026-326505 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49822 fkie_cve-2026-49822 2026-10-06T06:24:57.134580+00:00

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a low-privilege developer who could create a KubernetesWatchTrigger (KWT) in their own namespace was able to establish a persistent surveillance channel over any other namespace. This issue has been patched in version 1.24.0.

 https://cve.radiocsirt.org/vuln/ghsa-gc3j-79f2-7vvw GHSA-gc3j-79f2-7vvw — Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance 2026-10-06T06:24:57.134640+00:00

Affected: Go: github.com/fission/fission

### Summary

A low-privilege developer who could create a `KubernetesWatchTrigger` (KWT) in their own namespace was able to establish a persistent surveillance channel over any other namespace.

### Details

Two independent flaws compounded:

1. `pkg/kubewatcher/kubewatcher.go::createKubernetesWatch` used `w.Spec.Namespace` (user-controlled) directly as the Watch target without checking it against `w.Namespace` (the KWT's own namespace). `kubewatcher` established the Watch using its cluster-scoped service account and serialized every Pod/Service/Job change event as full JSON over HTTP POST to the attacker's function. 2. The validating webhook (`pkg/webhook/kuberneteswatchtrigger.go`) registered `verbs=create` only, so `update`/`patch` requests bypassed validation entirely.

A separate leak: an empty `spec.namespace` resolved to **all namespaces** via the controller's default, letting an attacker omit the field to surveil the entire cluster.

### Impact

A tenant with `kuberneteswatchtriggers.fission.io/create` could continuously receive full event payloads for Pods, Services, and Jobs in any namespace — a persistent cross-tenant surveillance channel requiring no additional privileges.

### Fix

Fixed in [#3379](https://github.com/fission/fission/pull/3379) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0).

- The validating webhook marker is extended to `verbs=create;update`. - `Validate` rejects `KubernetesWatchTrigger.spec.namespace != meta…