What’s Vulnerable › Products
fission vulnerabilities
17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.
Check whether your fission version is affected
Latest fission vulnerabilities
- CVE-2026-50570 — Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption (CVSS 8.5)
- CVE-2026-50569 — Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks (CVSS 4.3)
- CVE-2026-50568 — Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape (CVSS 3.6)
- CVE-2026-50567 — Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory (CVSS 7.7)
- CVE-2026-50566 — Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation (CVSS 9.9)
- CVE-2026-50565 — Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container (CVSS 4.9)
- CVE-2026-50564 — Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape (CVSS 9.9)
- CVE-2026-50563 — Fission Container Executor Function PodSpec Injection Leading to Node Escape (CVSS 9.9)
- CVE-2026-50545 — Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover (CVSS 9.9)
- CVE-2026-49824 — Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook (CVSS 8.5)
- CVE-2026-49823 — Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook (CVSS 7.7)
- CVE-2026-49822 — Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance (CVSS 7.7)
- CVE-2026-49821 — Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration (CVSS 7.7)
- CVE-2026-46618 — Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables (CVSS 6.9)
- CVE-2026-46617 — Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read (CVSS 8.7)
- CVE-2026-46614 — Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger (CVSS 9.8)
- CVE-2026-46612 — Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives (CVSS 8.8)