https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:43:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326538 EUVD-2026-326538 https://cve.radiocsirt.org/vuln/euvd-2026-326538 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49823 <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; PackageRef.Namespace was not. This issue has been patched in version 1.24.0.</p> <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; PackageRef.Namespace was not. This issue has been patched in version 1.24.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49823 https://cve.radiocsirt.org/vuln/ghsa-3r8v-2xmj-5c39 <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; `PackageRef.Namespace` was not.</p> <p>### Details</p> <p>A tenant with `functions.fission.io/create` in their own namespace could set `spec.package.packageref.namespace` to any other namespace. When the function is invoked, the fetcher sidecar reads the victim Package using the `fission-fetcher` service account&#39;s namespace-wide `get packages` permission and writes its contents to `/userfunc/deployarchive` inside the attacker&#39;s pool pod, exposing the victim&#39;s source code and any embedded credentials.</p> <p>The `fission-fetcher` SA holds `get packages` in every configured function namespace (granted by `charts/fission-all/templates/_function-access-role.tpl`), so the namespace check was the only barrier between the attacker and any in-cluster Fission Package.</p> <p>### Impact</p> <p>A function author in one namespace could read the deployment archive — and therefore the source code and embedded secrets — of any Package in any other namespace.</p> <p>### Fix</p> <p>Fixed in [#3389](https://github.com/fission/fission/pull/3389) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0).</p> <p>The admission webhook (`pkg/webhook/function.go::Validate`) rejects `Function.spec.package.packageref.namespace != metadata.namespace`. An empty namespace remains accepted (controllers default it to the function&#39;s namespace). This shipped together…</p> <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; `PackageRef.Namespace` was not.</p> <p>### Details</p> <p>A tenant with `functions.fission.io/create` in their own namespace could set `spec.package.packageref.namespace` to any other namespace. When the function is invoked, the fetcher sidecar reads the victim Package using the `fission-fetcher` service account&#39;s namespace-wide `get packages` permission and writes its contents to `/userfunc/deployarchive` inside the attacker&#39;s pool pod, exposing the victim&#39;s source code and any embedded credentials.</p> <p>The `fission-fetcher` SA holds `get packages` in every configured function namespace (granted by `charts/fission-all/templates/_function-access-role.tpl`), so the namespace check was the only barrier between the attacker and any in-cluster Fission Package.</p> <p>### Impact</p> <p>A function author in one namespace could read the deployment archive — and therefore the source code and embedded secrets — of any Package in any other namespace.</p> <p>### Fix</p> <p>Fixed in [#3389](https://github.com/fission/fission/pull/3389) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0).</p> <p>The admission webhook (`pkg/webhook/function.go::Validate`) rejects `Function.spec.package.packageref.namespace != metadata.namespace`. An empty namespace remains accepted (controllers default it to the function&#39;s namespace). This shipped together…</p> https://cve.radiocsirt.org/vuln/ghsa-3r8v-2xmj-5c39