Read the docs
TI-2026-34273 Aliases CVE-2026-46617GHSA-85g2-pmrx-r49q

Improper privilege management in fission

Priority MEDIUM 44CWE-250Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-250.

Summary

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, Fission runtime pods were created with ServiceAccountName: fission-fetcher, and the fission-fetcher ServiceAccount was granted namespace-wide get on secrets and configmaps (it needs that to load function code, env vars, and config). The runtime pod's automounted token was reachable from inside the user's function container at /var/run/secrets/kubernetes.io/serviceaccount/token, so user-supplied function code inherited the same Kubernetes API privileges and could read any secret or configmap in the function's namespace — far beyond the Function.spec.secrets allowlist that the function specification suggests. This issue has been patched in version 1.23.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Fix Fixed fission (fission): 1.23.0github.com/fission/fission (Go): 1.23.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fissionfissionbefore 1.23.01.23.0Patch availableCNA
—github.com/fission/fission (Go)before 1.23.01.23.0Patch availableGHSA-85g2-pmrx-r49q
  • fission Vendorfission Affected before 1.23.0 Fixed in 1.23.0 Patch available CNA
  • github.com/fission/fission (Go) Vendor— Affected before 1.23.0 Fixed in 1.23.0 Patch available GHSA-85g2-pmrx-r49q

Remediation

  • Fix · CNA fission (fission) Fixed in 1.23.0
  • Fix · GHSA-85g2-pmrx-r49q github.com/fission/fission (Go) Fixed in 1.23.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46617
  2. 2026-10-03 Alias added: GHSA-85g2-pmrx-r49q

References

Advisory 1

Other 4

  • TI-2026-34271 Improper access control in fission CVSS 3.1CRITICAL 9.8
  • TI-2026-37288 Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation CVSS 3.1CRITICAL 9.9
  • TI-2026-37286 Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape CVSS 3.1CRITICAL 9.9
  • TI-2026-37285 Fission Container Executor Function PodSpec Injection Leading to Node Escape CVSS 3.1CRITICAL 9.9
  • TI-2026-37268 Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover CVSS 3.1CRITICAL 9.9
  • TI-2026-34270 Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives CVSS 3.1HIGH 8.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences