CVE-2026-49822 Details

A cross-namespace event leakage vulnerability has been identified in Fission, an open-source serverless framework for Kubernetes. This issue affects versions through 1.23.0. A low-privilege developer could create a KubernetesWatchTrigger in their own namespace, allowing them to establish a persistent surveillance channel over any other namespace. The vulnerability arises from two independent flaws: first, the Kubernetes watch target was not properly validated, enabling unauthorized surveillance of events in other namespaces; second, the validating webhook allowed certain requests to bypass validation, creating an additional leak that could be exploited to surveil the entire cluster.

The vulnerability has been fixed in Fission version 1.24.0. Users should upgrade to this version. Instructions for upgrading can be found in the Fission installation guide.