CVE-2026-49824: Fission improper authorization via cross-namespace environment references

CVE-2026-49824 · Severity: high · CVSS 8.5 · Published 2026-06-10

Fission is a framework for running serverless functions on Kubernetes. A security flaw allowed users to run their own code inside the software environments belonging to other users or departments. This could lead to the theft of sensitive data, such as hardcoded passwords or proprietary code, and allow an attacker to bypass security boundaries between different teams.

Technologies: Fission, github.com/fission/fission (Go). Vendors: Fission, Go.

Quick answers

Is CVE-2026-49824 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49824 being exploited in the wild.
How severe is CVE-2026-49824?
High severity, with a CVSS score of 8.5, published 10 June 2026.
Which products and versions are affected?
Fission <= 1.23.0; github.com/fission/fission (Go) <= 1.23.0, SEMVER:introduced=0,fixed=1.24.0.
Is there a fix for CVE-2026-49824?
Yes. github.com/fission/fission (Go): upgrade to 1.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49824 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49824?
Check whether you run Fission or github.com/fission/fission (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/fission/fission (Go): upgrade to 1.24.0 or later
    go get github.com/fission/fission@v1.24.0

Technical details

The Fission Function admission webhook in `pkg/webhook/function.go` failed to validate the `spec.environment.namespace` field, despite correctly validating secrets and configmaps. An attacker with `functions.fission.io/create` permissions in their own namespace could specify a victim's namespace in the environment reference. When the `poolmgr` or `newdeploy` components schedule the function, they pull the victim's Environment CRD, causing the attacker's code to execute within the victim's container image. This facilitates credential theft from environment variables/images and confused-deputy attacks. The fix in v1.24.0 introduces validation in the webhook and redundant checks in the controller to prevent bypasses.

Affected products

  • Fission Fission <= 1.23.0

Identifiers

  • CVE-2026-49824
  • GHSA-cvw6-gfvv-953q
  • GO-2026-5852

Timeline

  • 2026-05-26: disclosed
  • 2026-06-10: advisory: NVD publication
  • 2026-06-30: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.