Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/fission/fission | go | <= 1.23.0 | 1.24.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the Fission framework, allowing a low-privilege user to surveil any namespace in a Kubernetes cluster. This is due to two main flaws in the handling of KubernetesWatchTrigger resources.
The primary vulnerable function is createKubernetesWatch in pkg/kubewatcher/kubewatcher.go. This function was responsible for creating the actual Kubernetes watch. It directly used the spec.namespace field from the KubernetesWatchTrigger custom resource to determine which namespace to watch. However, it failed to validate that this namespace was the same as the namespace of the KubernetesWatchTrigger itself. This oversight allowed a user to create a trigger in their own namespace but point it to any other namespace, effectively bypassing namespace-based security boundaries.
Compounding this issue was a flaw in the validating webhook for KubernetesWatchTrigger resources, located in pkg/webhook/kuberneteswatchtrigger.go. The webhook was only configured to validate create operations, not update or patch operations. This meant an attacker could create a seemingly benign KubernetesWatchTrigger and then update it to target a different namespace, bypassing the initial validation. Furthermore, the Validate function within the webhook was also missing the necessary logic to prevent cross-namespace watches.
The patch addresses these issues by:
createKubernetesWatch to ensure the spec.namespace of the KubernetesWatchTrigger matches its own namespace.spec.namespace to the trigger's own namespace, preventing it from defaulting to all namespaces.update operations.Validate function in the webhook.By identifying these functions, security engineers can understand the root cause of the vulnerability and confirm that their systems are patched. The presence of createKubernetesWatch or in a runtime profile during the creation or update of a would indicate that the vulnerable code path is being executed.
KubernetesWatchTrigger.ValidateKubernetesWatchTriggercreateKubernetesWatchpkg/kubewatcher/kubewatcher.go
KubernetesWatchTrigger.Validatepkg/webhook/kuberneteswatchtrigger.go