CVE-2026-46612: Fission Serverless Framework Missing Authentication in Archive Service

Technical summary

The storagesvc component in Fission versions prior to 1.23.0 exposes HTTP endpoints for archive operations (/v1/archive, /v1/archives) directly on its ClusterIP without middleware or admission controls. The affected endpoints support GET (download), POST (upload), and DELETE operations. The vulnerability stems from missing authentication and authorization enforcement (CWE-306: Missing Authentication for Critical Function), allowing any network caller with ClusterIP reachability to perform unrestricted CRUD operations on archives that may belong to other tenants or namespaces.

Business impact

In multi-tenant or shared Kubernetes clusters, this vulnerability enables horizontal privilege escalation and cross-tenant data exfiltration. An attacker could extract proprietary function code, intellectual property embedded in archives, and configuration secrets. Additionally, archive deletion or malicious replacement creates operational risk: legitimate functions may fail, or trojaned code could execute in customer environments. Organizations relying on Fission for production workloads face potential compliance violations (data isolation) and supply-chain risks.

Affected systems

Fission versions before 1.23.0 are vulnerable. This includes all deployments of Fission's storagesvc component in Kubernetes clusters, regardless of cloud provider or on-premises infrastructure. The exposure is internal to the cluster; external attackers require prior cluster compromise. However, the low barrier to exploitation within a cluster (any pod can make HTTP requests to ClusterIP addresses) means the risk surface is broad in multi-tenant environments.

Exploitability

Exploitability is high within a Kubernetes cluster. An attacker needs only network access to the storagesvc ClusterIP and basic HTTP client capabilities—no special tools or zero-days required. The CVSS vector (AV:N/AC:L/PR:L) reflects that the attacker must be authenticated to the Kubernetes cluster (PR:L), but once inside, exploitation is trivial: simple curl or HTTP library calls suffice. No user interaction is needed. External exploitation requires prior cluster compromise, which elevates the attack chain complexity but does not mitigate internal risk.

Remediation

Upgrade Fission to version 1.23.0 or later immediately. Verify the upgrade path with the Fission release notes to confirm storagesvc patching. As an interim control pending patch deployment, restrict network policies to limit access to storagesvc ClusterIP only to authorized namespace(s), and audit logs for unexpected archive access patterns. Consider service mesh policies (Istio, Cilium) to enforce mutual TLS and fine-grained authorization, though these do not replace the upstream fix.

Patch guidance

Apply Fission version 1.23.0 or newer according to your deployment model (Helm chart, operator, or manual manifests). Consult the Fission release notes and vendor advisory to confirm patch completeness and any migration steps. Test in a non-production environment first to validate backward compatibility with your function definitions and CI/CD pipelines. Coordinate patching across all Fission deployments in your infrastructure to close the window of exposure.

Detection guidance

Monitor storagesvc logs and network traffic for unusual archive access patterns: repeated GET requests from unexpected pods, POST requests outside normal deployment windows, or DELETE operations. Query audit logs for anomalous calls to /v1/archive and /v1/archives endpoints. Implement Kubernetes network policies to log traffic to storagesvc ClusterIP and review for sources outside the control plane namespace. Consider runtime security tools (Falco, Tetragon) to detect process execution patterns indicative of archive reconnaissance within containers.

Why prioritize this

This vulnerability scores 8.8 (HIGH severity) due to the combination of high confidentiality and integrity impact, low attack complexity, and the ubiquity of multi-tenant Kubernetes clusters. The absence of authentication or authorization—not mere misconfiguration—makes it a design-level flaw. Although the attack vector is internal to the cluster, the ease of exploitation and the sensitivity of function code and embedded secrets justify immediate patching. Organizations should treat this as priority within their Fission estates, especially those running shared clusters or handling regulated workloads.

Risk score, explained

CVSS 3.1 score of 8.8 reflects HIGH severity: Confidentiality Impact (High) due to unauthorized archive download, Integrity Impact (High) due to upload and deletion capabilities, and Availability Impact (High) due to delete operations. Attack Vector (Network) and Attack Complexity (Low) indicate the HTTP API is directly callable. Privileges Required (Low) captures the requirement to be a pod within the cluster—a reasonable constraint in a trusted boundary, but one that fails in multi-tenant scenarios. The lack of User Interaction (None) confirms the flaw is exploitable without social engineering.

Frequently asked questions