CVE-2026-46617 Details
Description
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, Fission runtime pods were created with ServiceAccountName: fission-fetcher, and the fission-fetcher ServiceAccount was granted namespace-wide get on secrets and configmaps (it needs that to load function code, env vars, and config). The runtime pod's automounted token was reachable from inside the user's function container at /var/run/secrets/kubernetes.io/serviceaccount/token, so user-supplied function code inherited the same Kubernetes API privileges and could read any secret or configmap in the function's namespace — far beyond the Function.spec.secrets allowlist that the function specification suggests. This issue has been patched in version 1.23.0.
A vulnerability exists in Fission, a serverless framework for Kubernetes, prior to version 1.23.0. In affected versions, runtime pods are assigned the 'fission-fetcher' service account, which has namespace-wide permissions to read secrets and configmaps. This service account token is automatically mounted into user function containers, allowing function code to access any secret or configmap in the namespace, bypassing the intended allowlist. The issue has been resolved in version 1.23.0 by changing the service account token handling, so user containers no longer have access to the token while the fetcher sidecar retains its necessary permissions.
Users can upgrade to Fission version 1.23.0 or later, where this vulnerability has been patched. Until upgrading, it is recommended to restrict who can create or update functions and packages in the cluster, reduce the scope of the 'fission-fetcher' service account permissions where possible, and implement network policies to deny function pods access to the Kubernetes API server.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/fission/fission/pull/3366 | [email protected] | Source CodeVendor |
| https://github.com/fission/fission/releases/tag/v1.23.0 | [email protected] | Release NotesVendor |
| https://github.com/fission/fission/security/advisories/GHSA-85g2-pmrx-r49q | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-250 | Execution with Unnecessary Privileges | [email protected] |
| CWE-269 | Improper Privilege Management | [email protected] |
| CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Fission | <= 1.22.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |