Vulnerabilities

TI-2026-37292 CVE-2026-50570 · GHSA-qf5v-m7p4-95rp

Improper privilege management in fission

LOW 37

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00274 Published 2026-06-10 Fixed in 1.25.0 CWE-269

TI-2026-37291 CVE-2026-50569 · GHSA-vchh-r53j-8mpw

Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

LOW 19

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00228 Published 2026-06-10 Fixed in 1.25.0 CWE-20

TI-2026-37290 CVE-2026-50568 · GHSA-r5jh-q2mw-gcx4

Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape

LOW 16

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1LOW 3.6 Local Low privileges No interaction EPSS 0.00115 Published 2026-06-10 Fixed in 1.25.0 CWE-41

TI-2026-37289 CVE-2026-50567 · GHSA-q6vm-xqc9-v3ff

Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory

LOW 33

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00301 Published 2026-06-10 Fixed in 1.25.0 CWE-22

TI-2026-37288 CVE-2026-50566 · GHSA-m63v-2g9w-2w6v

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

MEDIUM 43

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0029 Published 2026-06-10 Fixed in 1.24.0 CWE-250

TI-2026-37287 CVE-2026-50565 · GHSA-8wcj-mfrc-jx5q

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

LOW 22

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00256 Published 2026-06-10 Fixed in 1.24.0 CWE-250

TI-2026-37286 CVE-2026-50564 · GHSA-gx55-f84r-v3r7

Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape

MEDIUM 43

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00274 Published 2026-06-10 Fixed in 1.24.0 CWE-269

TI-2026-37285 CVE-2026-50563 · GHSA-v455-mv2v-5g92

Fission Container Executor Function PodSpec Injection Leading to Node Escape

MEDIUM 43

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00274 Published 2026-06-10 Fixed in 1.24.0 CWE-269

TI-2026-37268 CVE-2026-50545 · GHSA-wmgg-3p4h-48x7

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

MEDIUM 43

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.003 Published 2026-06-10 Fixed in 1.24.0 CWE-269

TI-2026-36730 CVE-2026-49824 · GHSA-cvw6-gfvv-953q

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook

LOW 36

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00236 Published 2026-06-10 Fixed in 1.24.0 CWE-284

TI-2026-36729 CVE-2026-49823 · GHSA-3r8v-2xmj-5c39

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook

LOW 33

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00265 Published 2026-06-10 Fixed in 1.24.0 CWE-284

TI-2026-36728 CVE-2026-49822 · GHSA-gc3j-79f2-7vvw

Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance

LOW 33

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00231 Published 2026-06-10 Fixed in 1.24.0 CWE-284

TI-2026-36727 CVE-2026-49821 · GHSA-vjhc-cf4p-72q4

Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration

LOW 33

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00231 Published 2026-06-10 Fixed in 1.24.0 CWE-441

TI-2026-34274 CVE-2026-46618 · GHSA-7pjr-qpvh-m339

Improper privilege management in fission

LOW 36

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00364 Published 2026-06-10 Fixed in 1.23.0 CWE-250

TI-2026-34273 CVE-2026-46617 · GHSA-85g2-pmrx-r49q

Improper privilege management in fission

MEDIUM 44

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00346 Published 2026-06-10 Fixed in 1.23.0 CWE-250

TI-2026-34270 CVE-2026-46612 · GHSA-chf8-4hv6-8pg6

Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives

MEDIUM 40

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00344 Published 2026-06-10 Fixed in 1.23.0 CWE-306

TI-2026-34271 CVE-2026-46614 · GHSA-3g33-6vg6-27m8

Improper access control in fission

MEDIUM 49

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00353 Published 2026-06-10 Fixed in 1.23.0 CWE-284

Vulnerabilities

Filters