8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49824

CVE-2026-49824: Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook

Summary

The Fission Function admission webhook (pkg/webhook/function.go) validated that spec.secrets[].namespace and spec.configmaps[].namespace equalled the function's own namespace but performed no equivalent check on spec.environment.namespace.

Details

An attacker with permission to create Functions in their own namespace could set spec.environment.namespace to any other tenant's namespace. poolmgr and newdeploy would then look up and use the victim's Environment CRD when scheduling function pods, so the attacker's function executed inside the victim's container image.

This is useful both for code and credential theft — the victim's runtime image may contain hardcoded secrets — and for confused-deputy attacks where the victim's runtime image is a privileged sidecar.

Impact

A tenant with functions.fission.io/create could run their own function code inside another tenant's container image, breaking the namespace trust boundary that the Function specification implies.

Fix

Fixed in #3389 and released in v1.24.0.

Admission webhook (pkg/webhook/function.go::Validate) rejects Function.spec.environment.namespace != metadata.namespace. An empty namespace remains accepted (the CLI defaults it to the function's namespace).
Controller belt-and-braces: the same check runs before the cross-namespace Environments(...).Get in poolmgr getFunctionEnv and newdeploy fnCreate / RefreshFuncPods, covering webhook-bypass clusters (failurePolicy=Ignore) and stale Function objects from upgrade-before-restart windows.

Behavioural change

Functions that explicitly set spec.environment.namespace to a different namespace are now rejected at admission. Empty-string remains accepted.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49824

CVE-2026-49824:

8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/fission/fission	go	<= 1.23.0	1.24.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-cvw6-gfvv-953q, allowed a cross-namespace attack in the Fission serverless framework. The root cause was the lack of validation for the spec.environment.namespace field in the Function custom resource. An attacker with permissions to create functions in one namespace could create a function that pointed to an environment in a different, victim namespace.

The primary point of failure was the admission webhook's Function.Validate method in pkg/webhook/function.go, which was responsible for validating Function objects upon creation or update but failed to check for this cross-namespace reference. This allowed malicious Function objects to be persisted in the cluster.

Downstream controllers, which are responsible for the actual execution of functions, would then act on these malicious objects. Specifically, the newdeploy and poolmgr executor types contained vulnerable logic. The NewDeploy.fnCreate and NewDeploy.RefreshFuncPods functions in pkg/executor/executortype/newdeploy/newdeploymgr.go, and the GenericPoolManager.getFunctionEnv function in pkg/executor/executortype/poolmgr/gpm.go, would proceed to fetch and use the environment from the specified foreign namespace. This would cause the attacker's function code to be executed within the victim's environment, breaking tenant isolation and leading to potential code and credential theft.

The patch addresses this by first fixing the root cause in the Function.Validate webhook. Additionally, it adds "defense-in-depth" checks to the fnCreate, RefreshFuncPods, and getFunctionEnv functions to prevent exploitation even if the webhook is misconfigured or bypassed, or if stale, pre-patch Function objects exist in the cluster.

Vulnerable functions

Function.Validate

pkg/webhook/function.go

This function is part of the admission webhook for Fission Functions. It was vulnerable because it failed to validate that the `spec.environment.namespace` matched the function's own namespace. This allowed an attacker to create a Function that referenced an Environment in a different namespace, leading to a cross-tenant attack.

NewDeploy.fnCreate

pkg/executor/executortype/newdeploy/newdeploymgr.go

This function is responsible for creating the necessary Kubernetes resources (like Deployments) for a function. Before the patch, it would use the `Environment` specified in the function's spec without validating its namespace. This meant that if a malicious Function object made it past the (at the time, non-validating) webhook, this function would create a deployment using an environment from a victim's namespace, allowing the attacker's code to run with the victim's environment.

NewDeploy.RefreshFuncPods

pkg/executor/executortype/newdeploy/newdeploymgr.go

This function is called to refresh the pods for a given function. It was vulnerable for the same reason as `fnCreate`; it would look up the environment to use for the new pods without validating that the environment's namespace was the same as the function's, thus allowing an attacker's function to be scheduled using a victim's environment.

GenericPoolManager.getFunctionEnv

pkg/executor/executortype/poolmgr/gpm.go

This function is used by the pool manager executor to get the environment for a function. It was vulnerable because it would retrieve the specified `Environment` custom resource from any namespace, as directed by the `Function` spec. An attacker could exploit this to have their function's code loaded into a pre-warmed pod running a victim's environment, potentially gaining access to secrets or executing code in a privileged context.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.