CVE-2026-49821: Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-10 · updated 2026-06-17
Weakness: CWE-441

Description

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that Package.spec.environment.namespace matched Package.metadata.namespace. This issue has been patched in version 1.24.0.

Affected products

fission: before 1.24.0

References

https://github.com/fission/fission/pull/3379
https://github.com/fission/fission/releases/tag/v1.24.0
https://github.com/fission/fission/security/advisories/GHSA-vjhc-cf4p-72q4

Get alerted when CVE-2026-49821 or the next vulnerability affects your stack