CVE-2026-49821
Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration
CVSS Score
7.7
EPSS Score
0.0%
EPSS Percentile
0th
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that Package.spec.environment.namespace matched Package.metadata.namespace. This issue has been patched in version 1.24.0.
| CWE | CWE-441 CWE-862 |
| Vendor | fission |
| Product | fission |
| Published | Jun 10, 2026 |
| Last Updated | Jun 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for fission fission
Be the first to know when new high vulnerabilities affecting fission fission are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
fission / fission
< 1.24.0