https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 17:08:27 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326789 EUVD-2026-326789 https://cve.radiocsirt.org/vuln/euvd-2026-326789 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46612 <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission storagesvc component registers archive CRUD handlers (/v1/archive GET / POST / DELETE and /v1/archives list) directly on its HTTP router without performing any authentication or authorization. Any caller able to reach the storagesvc ClusterIP — including any other workload in the same Kubernetes cluster — could enumerate archive IDs, download archives belonging to other tenants, upload arbitrary archive content, and delete archives. This issue has been patched in version 1.23.0.</p> <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission storagesvc component registers archive CRUD handlers (/v1/archive GET / POST / DELETE and /v1/archives list) directly on its HTTP router without performing any authentication or authorization. Any caller able to reach the storagesvc ClusterIP — including any other workload in the same Kubernetes cluster — could enumerate archive IDs, download archives belonging to other tenants, upload arbitrary archive content, and delete archives. This issue has been patched in version 1.23.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46612 https://cve.radiocsirt.org/vuln/ghsa-chf8-4hv6-8pg6 <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>The Fission `storagesvc` component registers archive CRUD handlers (`/v1/archive` GET / POST / DELETE and `/v1/archives` list) directly on its HTTP router without performing any authentication or authorization. Any caller able to reach the `storagesvc` ClusterIP — including any other workload in the same Kubernetes cluster — could enumerate archive IDs, download archives belonging to other tenants, upload arbitrary archive content, and delete archives.</p> <p>### Affected component</p> <p>- `pkg/storagesvc/storagesvc.go` — handler registration and per-route handler logic at lines 72-95 (list), 167-199 (download/delete), and 263-270 (route wiring).</p> <p>### Impact</p> <p>A workload elsewhere in the cluster (e.g. a compromised function pod, a noisy-neighbour tenant in a multi-tenant deployment, or any pod whose egress is not constrained by NetworkPolicy) could:</p> <p>1. Enumerate every function deployment archive in the cluster. 2. Download the deployment archive of any function in any namespace, exposing the function&#39;s source code and any embedded secrets. 3. Delete archives, causing the next function specialization or rebuild to fail. 4. Upload arbitrary archives that subsequent function specializations would fetch and execute.</p> <p>In multi-tenant Fission deployments this completely breaks the tenant boundary for function code.</p> <p>### Root cause</p> <p>`pkg/storagesvc/storagesvc.go` mounts the handlers without an authentication middleware. Network-layer controls (`NetworkPolicy`) we…</p> <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>The Fission `storagesvc` component registers archive CRUD handlers (`/v1/archive` GET / POST / DELETE and `/v1/archives` list) directly on its HTTP router without performing any authentication or authorization. Any caller able to reach the `storagesvc` ClusterIP — including any other workload in the same Kubernetes cluster — could enumerate archive IDs, download archives belonging to other tenants, upload arbitrary archive content, and delete archives.</p> <p>### Affected component</p> <p>- `pkg/storagesvc/storagesvc.go` — handler registration and per-route handler logic at lines 72-95 (list), 167-199 (download/delete), and 263-270 (route wiring).</p> <p>### Impact</p> <p>A workload elsewhere in the cluster (e.g. a compromised function pod, a noisy-neighbour tenant in a multi-tenant deployment, or any pod whose egress is not constrained by NetworkPolicy) could:</p> <p>1. Enumerate every function deployment archive in the cluster. 2. Download the deployment archive of any function in any namespace, exposing the function&#39;s source code and any embedded secrets. 3. Delete archives, causing the next function specialization or rebuild to fail. 4. Upload arbitrary archives that subsequent function specializations would fetch and execute.</p> <p>In multi-tenant Fission deployments this completely breaks the tenant boundary for function code.</p> <p>### Root cause</p> <p>`pkg/storagesvc/storagesvc.go` mounts the handlers without an authentication middleware. Network-layer controls (`NetworkPolicy`) we…</p> https://cve.radiocsirt.org/vuln/ghsa-chf8-4hv6-8pg6