CVE-2026-49824: Fission Auth Bypass Vulnerability

CVE-2026-49824 Overview

Fission is an open-source, Kubernetes-native serverless framework for deploying functions on Kubernetes clusters. CVE-2026-49824 affects the Fission Function admission webhook in pkg/webhook/function.go. The webhook validates that spec.secrets[].namespace and spec.configmaps[].namespace match the function's own namespace but performs no equivalent check on spec.environment.namespace. This missing access control [CWE-284] allows a tenant with permissions in one namespace to reference an environment in another namespace, enabling cross-namespace access in multi-tenant Kubernetes clusters. The issue is patched in Fission version 1.24.0.

Critical Impact

Authenticated users can reference Fission environments across namespace boundaries, breaking multi-tenant isolation and exposing confidential resources in shared clusters.

Affected Products

• Fission serverless framework versions prior to 1.24.0
• Kubernetes clusters running the Fission Function admission webhook
• Multi-tenant Fission deployments relying on namespace isolation

Discovery Timeline

• 2026-06-10 - CVE-2026-49824 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-49824

Vulnerability Analysis

The Fission Function admission webhook enforces namespace boundaries on referenced secrets and config maps. The webhook compares spec.secrets[].namespace and spec.configmaps[].namespace against the namespace of the function being created. The check rejects cross-namespace references for those two fields. The webhook omits the same validation for spec.environment.namespace, allowing a function to declare an environment located in any namespace.

Fission environments contain container images, builder configurations, and runtime settings. A tenant who can create functions in their assigned namespace can reference an environment owned by another tenant. This breaks the namespace isolation model that Kubernetes operators rely on for multi-tenant clusters. The flaw maps to CWE-284 (Improper Access Control) and exhibits a scope change because the impact extends beyond the attacker's namespace into resources owned by other tenants.

Root Cause

The root cause is an incomplete validation routine in pkg/webhook/function.go. The function-level admission logic was extended to cover secret and config map references but never updated to include the environment reference. The omission creates an authorization gap because the webhook is the enforcement point for tenant boundaries on function specifications.

Attack Vector

An attacker authenticates to the Kubernetes API with permissions to create Fission Function resources in at least one namespace. The attacker submits a Function manifest where spec.environment.namespace points to a namespace the attacker does not control. The admission webhook accepts the manifest, and Fission uses the referenced environment to execute the attacker's function code. This grants indirect access to environment configurations and any privileges they carry. The attack vector is network-based, requires low privileges, and needs no user interaction.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-cvw6-gfvv-953q and the GitHub Pull Request Discussion for technical details on the patch.

Detection Methods for CVE-2026-49824

Indicators of Compromise

• Fission Function resources where spec.environment.namespace differs from the function's own metadata.namespace.
• Audit log entries showing functions.fission.io create or update operations from service accounts outside the environment's namespace.
• Unexpected pod executions referencing environment images owned by other tenants.

Detection Strategies

• Query the Kubernetes API for all Fission Function objects and flag any where spec.environment.namespace is set to a namespace different from the function's namespace.
• Enable Kubernetes audit logging at the RequestResponse level for the fission.io API group and review admission decisions for cross-namespace references.
• Deploy an OPA Gatekeeper or Kyverno policy that mirrors the missing webhook check and reports violations.

Monitoring Recommendations

• Track creation and modification events for functions.fission.io resources, focusing on the spec.environment field.
• Monitor Fission controller logs for environment lookups that cross namespace boundaries.
• Alert on Function resources created by service accounts that do not own the referenced environment.

How to Mitigate CVE-2026-49824

Immediate Actions Required

• Upgrade Fission to version 1.24.0 or later, which adds the missing namespace check on spec.environment.namespace.
• Audit existing Function resources for cross-namespace environment references and remove or correct any unauthorized entries.
• Restrict create and update permissions on functions.fission.io to trusted service accounts in multi-tenant clusters until the upgrade completes.

Patch Information

The fix is included in Fission v1.24.0. The patch extends the admission webhook in pkg/webhook/function.go to validate that spec.environment.namespace matches the function's namespace, applying the same check used for secrets and config maps. Review the GitHub Pull Request Discussion for the code change.

Workarounds

• Deploy a Kyverno or OPA Gatekeeper policy that rejects Fission Function manifests where spec.environment.namespace does not equal metadata.namespace.
• Limit Function creation permissions in multi-tenant namespaces using Kubernetes Role-Based Access Control until the patched version is deployed.
• Isolate sensitive Fission environments in clusters separate from untrusted tenant workloads.

# Upgrade Fission via Helm to the patched release
helm repo update
helm upgrade --install fission fission-charts/fission-all \
  --namespace fission \
  --version 1.24.0

# Audit existing functions for cross-namespace environment references
kubectl get functions.fission.io -A -o json | \
  jq -r '.items[] | select(.spec.environment.namespace != .metadata.namespace) |
    "\(.metadata.namespace)/\(.metadata.name) -> env \(.spec.environment.namespace)/\(.spec.environment.name)"'