CVE-2026-49823 Details
Description
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; PackageRef.Namespace was not. This issue has been patched in version 1.24.0.
A vulnerability exists in Fission versions prior to 1.24.0, allowing cross-namespace references in Function specifications. The admission webhook did not validate the namespace of Package references, enabling a tenant to access Packages from other namespaces. This issue could lead to unauthorized access to source code and embedded credentials from Packages in different namespaces.
Users can upgrade to Fission version 1.24.0 or later, where this vulnerability has been patched. Instructions for upgrading are available in the Fission release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/fission/fission/pull/3389 | [email protected] | Source CodeVendor |
| https://github.com/fission/fission/releases/tag/v1.24.0 | [email protected] | Release NotesVendor |
| https://github.com/fission/fission/security/advisories/GHSA-3r8v-2xmj-5c39 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Fission | <= 1.23.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |