Executive brief
Fission is a serverless framework that allows developers to run code functions on Kubernetes clusters. A security flaw in the storage component allowed any user or application within the same network to access, download, or delete private code archives without any authentication. This could lead to the theft of proprietary source code or the disruption of applications by deleting their underlying functions.
Technical details
The Fission 'storagesvc' component fails to implement authentication or authorization middleware for its archive CRUD handlers (/v1/archive and /v1/archives). An attacker with network access to the storagesvc ClusterIP—such as a compromised workload in the same Kubernetes cluster—can enumerate archive IDs, download archives belonging to other tenants, upload arbitrary content, or delete existing archives. The vulnerability stems from the component registering these handlers directly on its HTTP router without security checks (CWE-306). The issue is addressed in version 1.23.0 by introducing HMAC-SHA256 application-layer authentication and providing opt-in Kubernetes NetworkPolicies to restrict traffic.
Affected products
- Fission Fission < 1.23.0
Timeline
- 2026-05-07: other: NetworkPolicy mitigation merged
- 2026-05-09: other: HMAC authentication implementation merged
- 2026-05-15: patched: Version 1.23.0 released
- 2026-06-10: disclosed: CVE-2026-46612 published