7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49823

CVE-2026-49823: Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; PackageRef.Namespace was not. This issue has been patched in version 1.24.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49823

CVE-2026-49823:

7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/fission/fission	go	<= 1.23.0	1.24.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-3r8v-2xmj-5c39, lies in the Fission admission webhook's failure to validate cross-namespace package references. The provided vulnerability description explicitly states that PackageRef.Namespace was not validated by the admission webhook, and points to pkg/webhook/function.go::Validate as the location of the fix.

Analysis of the provided commit 80e7ba55228e1ef426f51353e25d2682ec61de34 confirms this. The patch adds a new validation check within the Validate method of the Function struct in pkg/webhook/function.go. This new code block checks if new.Spec.Package.PackageRef.Namespace is different from the function's own namespace (new.Namespace) and rejects the resource if it is.

The vulnerability is the absence of this check in the older code. An attacker would exploit this by submitting a Function custom resource where the PackageRef points to a package in a different namespace. The Function.Validate webhook would be invoked, and in its vulnerable state, it would approve the resource. The actual data exfiltration occurs later when the function is run, but the entry point and the root cause of the vulnerability is the missing validation in Function.Validate. Therefore, this function is the key runtime indicator when the vulnerability is being triggered.

Vulnerable functions

Function.Validate

pkg/webhook/function.go

This function serves as a validating webhook for Fission `Function` resources. Prior to the patch, it failed to validate that the namespace of a referenced package (`spec.package.packageref.namespace`) was the same as the function's namespace. This allowed an attacker with permission to create functions in one namespace to create a function that references a package from a different namespace. When the function was executed, the system would fetch the package from the victim's namespace and make its contents (source code and any embedded secrets) available to the attacker's function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.