4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50565

CVE-2026-50565: Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission builder pods were created with ServiceAccountName: fission-builder and no AutomountServiceAccountToken: false, so the kubelet auto-mounted the service-account token into every container in the pod — including the user-supplied builder image. This issue has been patched in version 1.24.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50565

CVE-2026-50565:

4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/fission/fission	go	<= 1.23.0	1.24.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows a user with permissions to create or update Fission Environment custom resources to gain read access to all secrets and configmaps within the Fission builder namespace. This is because the builder pods, which can run user-defined images, were created with the fission-builder ServiceAccount token automatically mounted.

The provided patch commit 8fa799417c77ce8a0189d9858bfe11ece29b84a6 clearly shows that the function createBuilderDeployment in pkg/buildermgr/envwatcher.go is responsible for creating these builder pods. The core of the vulnerability is that the PodSpec created by this function did not set AutomountServiceAccountToken to false. The fix involves explicitly setting this field to false at the pod level and ensuring that any user-provided pod specifications cannot override this setting. The function createBuilderDeployment is the central point where the vulnerable configuration was generated. Therefore, its execution is a primary indicator of the vulnerability being triggered when an Environment is created or updated.

Vulnerable functions

buildermgr.environmentWatcher.createBuilderDeployment

pkg/buildermgr/envwatcher.go

This function creates a builder deployment for a Fission environment. The vulnerability lies in the fact that it previously did not set `AutomountServiceAccountToken` to `false`. This resulted in the `fission-builder` service account token being automatically mounted into the user-supplied builder container, granting it permissions to read all secrets and configmaps in the builder namespace. The patch explicitly disables this token automounting for the pod and only mounts it for the fetcher container where it is needed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.