https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 04:26:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326505 EUVD-2026-326505 https://cve.radiocsirt.org/vuln/euvd-2026-326505 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49822 <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a low-privilege developer who could create a KubernetesWatchTrigger (KWT) in their own namespace was able to establish a persistent surveillance channel over any other namespace. This issue has been patched in version 1.24.0.</p> <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a low-privilege developer who could create a KubernetesWatchTrigger (KWT) in their own namespace was able to establish a persistent surveillance channel over any other namespace. This issue has been patched in version 1.24.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49822 https://cve.radiocsirt.org/vuln/ghsa-gc3j-79f2-7vvw <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>A low-privilege developer who could create a `KubernetesWatchTrigger` (KWT) in their own namespace was able to establish a persistent surveillance channel over any other namespace.</p> <p>### Details</p> <p>Two independent flaws compounded:</p> <p>1. `pkg/kubewatcher/kubewatcher.go::createKubernetesWatch` used `w.Spec.Namespace` (user-controlled) directly as the Watch target without checking it against `w.Namespace` (the KWT&#39;s own namespace). `kubewatcher` established the Watch using its cluster-scoped service account and serialized every Pod/Service/Job change event as full JSON over HTTP POST to the attacker&#39;s function. 2. The validating webhook (`pkg/webhook/kuberneteswatchtrigger.go`) registered `verbs=create` only, so `update`/`patch` requests bypassed validation entirely.</p> <p>A separate leak: an empty `spec.namespace` resolved to **all namespaces** via the controller&#39;s default, letting an attacker omit the field to surveil the entire cluster.</p> <p>### Impact</p> <p>A tenant with `kuberneteswatchtriggers.fission.io/create` could continuously receive full event payloads for Pods, Services, and Jobs in any namespace — a persistent cross-tenant surveillance channel requiring no additional privileges.</p> <p>### Fix</p> <p>Fixed in [#3379](https://github.com/fission/fission/pull/3379) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0).</p> <p>- The validating webhook marker is extended to `verbs=create;update`. - `Validate` rejects `KubernetesWatchTrigger.spec.namespace != meta…</p> <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>A low-privilege developer who could create a `KubernetesWatchTrigger` (KWT) in their own namespace was able to establish a persistent surveillance channel over any other namespace.</p> <p>### Details</p> <p>Two independent flaws compounded:</p> <p>1. `pkg/kubewatcher/kubewatcher.go::createKubernetesWatch` used `w.Spec.Namespace` (user-controlled) directly as the Watch target without checking it against `w.Namespace` (the KWT&#39;s own namespace). `kubewatcher` established the Watch using its cluster-scoped service account and serialized every Pod/Service/Job change event as full JSON over HTTP POST to the attacker&#39;s function. 2. The validating webhook (`pkg/webhook/kuberneteswatchtrigger.go`) registered `verbs=create` only, so `update`/`patch` requests bypassed validation entirely.</p> <p>A separate leak: an empty `spec.namespace` resolved to **all namespaces** via the controller&#39;s default, letting an attacker omit the field to surveil the entire cluster.</p> <p>### Impact</p> <p>A tenant with `kuberneteswatchtriggers.fission.io/create` could continuously receive full event payloads for Pods, Services, and Jobs in any namespace — a persistent cross-tenant surveillance channel requiring no additional privileges.</p> <p>### Fix</p> <p>Fixed in [#3379](https://github.com/fission/fission/pull/3379) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0).</p> <p>- The validating webhook marker is extended to `verbs=create;update`. - `Validate` rejects `KubernetesWatchTrigger.spec.namespace != meta…</p> https://cve.radiocsirt.org/vuln/ghsa-gc3j-79f2-7vvw