Technology · Fission
Fission vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 18 vulnerabilities in Fission: 0 in the last 7 days and 1 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, Fission privilege escalation in MessageQueueTrigger scaler manager, was published on 30 June 2026.
- Last 7 days
- 0
- Last 90 days
- 1
- Critical, all time
- 5
- Exploited in the wild
- 0
About Fission
Fission is an open-source, fast, and serverless framework for Kubernetes.
Latest Fission vulnerabilities
- Fission privilege escalation in MessageQueueTrigger scaler managerhighCVSS 8.1
- CVE-2026-50570: Fission incomplete capability denylist in Environment and Function CRDshighCVSS 8.5EPSS 0.5%
- CVE-2026-50569: Fission HTTPTrigger improper input validation in RelativeURL and PrefixmediumCVSS 4.3EPSS 0.4%
- CVE-2026-50568: Fission path traversal in SanitizeFilePath utilitylowCVSS 3.6EPSS 0.1%
- CVE-2026-50567: Fission path traversal in zip extraction utilityhighCVSS 7.7EPSS 0.4%
- CVE-2026-50566: Fission privilege escalation via Environment Container SecurityContext bypasscriticalCVSS 9.9EPSS 0.5%
- CVE-2026-50565: Fission privilege escalation via ServiceAccount token automount in builder podsmediumCVSS 4.9EPSS 0.4%
- CVE-2026-50564: Fission privilege escalation via PodSpec injection in Environment CRDcriticalCVSS 9.9EPSS 0.5%
- CVE-2026-50563: Fission Container Executor privilege escalation via PodSpec injectioncriticalCVSS 9.9EPSS 0.5%
- CVE-2026-50545: Fission PodSpec injection leading to node escape in Environment CRDcriticalCVSS 9.9EPSS 0.5%
- CVE-2026-49824: Fission improper authorization via cross-namespace environment referenceshighCVSS 8.5EPSS 0.4%
- CVE-2026-49823: Fission improper authorization in Function PackageRef namespace validationhighCVSS 7.7EPSS 0.4%
- CVE-2026-49822: Fission cross-namespace event leakage in KubernetesWatchTriggerhighCVSS 7.7EPSS 0.4%
- CVE-2026-49821: Fission cross-namespace auth bypass in buildermgr controllerhighCVSS 7.7EPSS 0.4%
- CVE-2026-46618: Fission OS command injection in builder componentmediumCVSS 4EPSS 0.6%
- CVE-2026-46617: Fission privilege escalation via ServiceAccount token leakage in runtime podshighCVSS 4EPSS 0.5%
- CVE-2026-46614: Fission auth bypass via internal route exposure in routercriticalCVSS 9.8EPSS 0.7%
- CVE-2026-46612: Fission missing authentication in storagesvc archive handlershighCVSS 8.8EPSS 0.7%
Most severe Fission vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-50545: Fission PodSpec injection leading to node escape in Environment CRDcriticalCVSS 9.9EPSS 0.5%
- CVE-2026-50566: Fission privilege escalation via Environment Container SecurityContext bypasscriticalCVSS 9.9EPSS 0.5%
- CVE-2026-50564: Fission privilege escalation via PodSpec injection in Environment CRDcriticalCVSS 9.9EPSS 0.5%
- CVE-2026-50563: Fission Container Executor privilege escalation via PodSpec injectioncriticalCVSS 9.9EPSS 0.5%
- CVE-2026-46614: Fission auth bypass via internal route exposure in routercriticalCVSS 9.8EPSS 0.7%
- CVE-2026-46612: Fission missing authentication in storagesvc archive handlershighCVSS 8.8EPSS 0.7%
- CVE-2026-50570: Fission incomplete capability denylist in Environment and Function CRDshighCVSS 8.5EPSS 0.5%
- CVE-2026-49824: Fission improper authorization via cross-namespace environment referenceshighCVSS 8.5EPSS 0.4%
- Fission privilege escalation in MessageQueueTrigger scaler managerhighCVSS 8.1
- CVE-2026-50567: Fission path traversal in zip extraction utilityhighCVSS 7.7EPSS 0.4%
Vulnerabilities per week
The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 29 Jun 2026 | 1 | 0 | |
| 6 Jul 2026 | 0 | 0 | |
| 13 Jul 2026 | 0 | 0 | |
| 20 Jul 2026 | 0 | 0 | |
| 27 Jul 2026 | 0 | 0 | |
| 3 Aug 2026 | 0 | 0 | |
| 10 Aug 2026 | 0 | 0 | |
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 |
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/fission.json, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Fission vulnerabilities", https://junglewise.ai/threats/technologies/fission, 26 September 2026.