Executive brief
Fission is a serverless framework that allows developers to run code functions on Kubernetes. A security flaw in the system's routing component allowed anyone with network access to the framework to bypass security rules and trigger any hosted function. This could lead to unauthorized execution of code, data exposure, or disruption of services by bypassing intended access controls.
Technical details
A vulnerability in the Fission router component exists where internal-style routes (/fission-function/<name>) were registered for every Function object regardless of whether an HTTPTrigger was defined. These routes were mounted on the same public listener (port 8888) as user-defined triggers. An unauthenticated attacker with network reachability to the router could invoke any function by guessing its metadata name and namespace, effectively bypassing host, path, and method restrictions defined in HTTPTrigger objects. The fix in version 1.23.0 involves splitting the router into two listeners: a public one (8888) for user triggers and a new internal one (8889) for internal function calls, protected by NetworkPolicies and HMAC authentication.
Affected products
- Fission Fission < 1.23.0
Timeline
- 2026-05-07: other: NetworkPolicy mitigation PR merged
- 2026-05-09: other: HMAC auth and listener split PR merged
- 2026-05-15: patched: Version 1.23.0 released
- 2026-06-10: disclosed: CVE-2026-46614 published