https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 06:42:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326490 EUVD-2026-326490 https://cve.radiocsirt.org/vuln/euvd-2026-326490 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49824 <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Fission Function admission webhook (pkg/webhook/function.go) validated that spec.secrets[].namespace and spec.configmaps[].namespace equalled the function&#39;s own namespace but performed no equivalent check on spec.environment.namespace. This issue has been patched in version 1.24.0.</p> <p>Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Fission Function admission webhook (pkg/webhook/function.go) validated that spec.secrets[].namespace and spec.configmaps[].namespace equalled the function&#39;s own namespace but performed no equivalent check on spec.environment.namespace. This issue has been patched in version 1.24.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49824 https://cve.radiocsirt.org/vuln/ghsa-cvw6-gfvv-953q <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>The Fission Function admission webhook (`pkg/webhook/function.go`) validated that `spec.secrets[].namespace` and `spec.configmaps[].namespace` equalled the function&#39;s own namespace but performed no equivalent check on `spec.environment.namespace`.</p> <p>### Details</p> <p>An attacker with permission to create Functions in their own namespace could set `spec.environment.namespace` to any other tenant&#39;s namespace. poolmgr and newdeploy would then look up and use the victim&#39;s Environment CRD when scheduling function pods, so the attacker&#39;s function executed inside the victim&#39;s container image.</p> <p>This is useful both for code and credential theft — the victim&#39;s runtime image may contain hardcoded secrets — and for confused-deputy attacks where the victim&#39;s runtime image is a privileged sidecar.</p> <p>### Impact</p> <p>A tenant with `functions.fission.io/create` could run their own function code inside another tenant&#39;s container image, breaking the namespace trust boundary that the Function specification implies.</p> <p>### Fix</p> <p>Fixed in [#3389](https://github.com/fission/fission/pull/3389) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0).</p> <p>- **Admission webhook** (`pkg/webhook/function.go::Validate`) rejects `Function.spec.environment.namespace != metadata.namespace`. An empty namespace remains accepted (the CLI defaults it to the function&#39;s namespace). - **Controller belt-and-braces:** the same check runs before the cross-namespace `Environments(...).Get` in po…</p> <p><strong>Affected:</strong> Go: github.com/fission/fission</p> <p>### Summary</p> <p>The Fission Function admission webhook (`pkg/webhook/function.go`) validated that `spec.secrets[].namespace` and `spec.configmaps[].namespace` equalled the function&#39;s own namespace but performed no equivalent check on `spec.environment.namespace`.</p> <p>### Details</p> <p>An attacker with permission to create Functions in their own namespace could set `spec.environment.namespace` to any other tenant&#39;s namespace. poolmgr and newdeploy would then look up and use the victim&#39;s Environment CRD when scheduling function pods, so the attacker&#39;s function executed inside the victim&#39;s container image.</p> <p>This is useful both for code and credential theft — the victim&#39;s runtime image may contain hardcoded secrets — and for confused-deputy attacks where the victim&#39;s runtime image is a privileged sidecar.</p> <p>### Impact</p> <p>A tenant with `functions.fission.io/create` could run their own function code inside another tenant&#39;s container image, breaking the namespace trust boundary that the Function specification implies.</p> <p>### Fix</p> <p>Fixed in [#3389](https://github.com/fission/fission/pull/3389) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0).</p> <p>- **Admission webhook** (`pkg/webhook/function.go::Validate`) rejects `Function.spec.environment.namespace != metadata.namespace`. An empty namespace remains accepted (the CLI defaults it to the function&#39;s namespace). - **Controller belt-and-braces:** the same check runs before the cross-namespace `Environments(...).Get` in po…</p> https://cve.radiocsirt.org/vuln/ghsa-cvw6-gfvv-953q