https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T20:42:17.006262+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-326504 EUVD-2026-326504 2026-10-06T20:42:17.054968+00:00 EUVD-2026-326504 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50565 fkie_cve-2026-50565 2026-10-06T20:42:17.055007+00:00

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission builder pods were created with ServiceAccountName: fission-builder and no AutomountServiceAccountToken: false, so the kubelet auto-mounted the service-account token into every container in the pod — including the user-supplied builder image. This issue has been patched in version 1.24.0.

 https://cve.radiocsirt.org/vuln/ghsa-8wcj-mfrc-jx5q GHSA-8wcj-mfrc-jx5q — Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container 2026-10-06T20:42:17.055043+00:00

Affected: Go: github.com/fission/fission

### Summary

Fission builder pods were created with `ServiceAccountName: fission-builder` and no `AutomountServiceAccountToken: false`, so the kubelet auto-mounted the service-account token into every container in the pod — including the user-supplied builder image.

### Details

The user controls the builder container image, command, and podspec through `Environment.spec.builder.image` / `.container` / `.podspec`. With the SA token auto-mounted at `/var/run/secrets/kubernetes.io/serviceaccount/token` inside that container, any code running there inherited the `fission-builder` identity. The `fission-builder` SA holds namespace-wide `get` on `secrets` and `configmaps` (`pkg/utils/serviceaccount.go`), so the user-controlled builder container could read every Secret in the builder namespace by name.

This is the buildermgr sibling of GHSA-85g2-pmrx-r49q (CVE-2026-46617), whose fix suppressed the SA-token automount on function runtime pods but did not cover the structurally identical primitive in `pkg/buildermgr/envwatcher.go`.

### Impact

A subject with `create`/`update` on `Environment` CRDs in a namespace observed by the buildermgr could read every Secret and ConfigMap in the builder namespace via the auto-mounted `fission-builder` token.

### Fix

Fixed in [#3390](https://github.com/fission/fission/pull/3390) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0). In `createBuilderDeployment`:

- Set pod-level `AutomountServiceAccountToken=fals…