CVE-2026-46614: Fission auth bypass via internal route exposure in router

CVE-2026-46614 · Severity: critical · CVSS 9.8 · Published 2026-06-10

Fission is a serverless framework that allows developers to run code functions on Kubernetes. A security flaw in the system's routing component allowed anyone with network access to the framework to bypass security rules and trigger any hosted function. This could lead to unauthorized execution of code, data exposure, or disruption of services by bypassing intended access controls.

Technologies: Fission, github.com/fission/fission (Go). Vendors: Fission, Go.

Quick answers

Is CVE-2026-46614 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46614 being exploited in the wild.
How severe is CVE-2026-46614?
Critical severity, with a CVSS score of 9.8, published 10 June 2026.
Which products and versions are affected?
Fission < 1.23.0, <= 1.22.0; github.com/fission/fission (Go) <= 1.22.0, SEMVER:introduced=0,fixed=1.23.0.
Is there a fix for CVE-2026-46614?
Yes. github.com/fission/fission (Go): upgrade to 1.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46614 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46614?
Check whether you run Fission or github.com/fission/fission (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/fission/fission (Go): upgrade to 1.23.0 or later
    go get github.com/fission/fission@v1.23.0

Technical details

A vulnerability in the Fission router component exists where internal-style routes (/fission-function/<name>) were registered for every Function object regardless of whether an HTTPTrigger was defined. These routes were mounted on the same public listener (port 8888) as user-defined triggers. An unauthenticated attacker with network reachability to the router could invoke any function by guessing its metadata name and namespace, effectively bypassing host, path, and method restrictions defined in HTTPTrigger objects. The fix in version 1.23.0 involves splitting the router into two listeners: a public one (8888) for user triggers and a new internal one (8889) for internal function calls, protected by NetworkPolicies and HMAC authentication.

Affected products

  • Fission Fission < 1.23.0

Identifiers

  • CVE-2026-46614
  • GHSA-3g33-6vg6-27m8
  • GO-2026-5082

Timeline

  • 2026-05-07: other: NetworkPolicy mitigation PR merged
  • 2026-05-09: other: HMAC auth and listener split PR merged
  • 2026-05-15: patched: Version 1.23.0 released
  • 2026-06-10: disclosed: CVE-2026-46614 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.