Executive brief
Fission is a serverless framework for Kubernetes. A vulnerability in its event-triggering system allowed low-privileged users to monitor activity across the entire cluster, including sensitive information about applications running in other users' private areas. This could lead to the exposure of internal operational data and persistent surveillance of other tenants' activities.
Technical details
A vulnerability in Fission's KubernetesWatchTrigger (KWT) allows for cross-namespace event leakage due to improper validation and authorization checks. Specifically, 'pkg/kubewatcher/kubewatcher.go' used user-controlled namespace specifications without verifying them against the trigger's own namespace, while the validating webhook only monitored 'create' operations, allowing 'update' or 'patch' requests to bypass security checks. Additionally, an empty namespace field defaulted to watching all namespaces. An attacker with low privileges can exploit this to receive full JSON event payloads for Pods, Services, and Jobs cluster-wide. The issue is fixed in version 1.24.0 by extending webhook validation to update/patch operations and enforcing namespace parity.
Affected products
- fission fission <= 1.23.0
Timeline
- 2026-05-26: disclosed
- 2026-06-10: advisory: NVD publication
- 2026-06-30: patched: GitHub Advisory published/reviewed