CVE-2026-49823: Fission Kubernetes Namespace Isolation Bypass

Technical summary

In Fission's Function specification, PackageRef objects were not subject to namespace validation checks enforced by the admission webhook, unlike SecretRef and ConfigMapRef. The PackageRef.Namespace field could reference packages outside the Function's own namespace without restriction. Since admission webhooks are a primary enforcement mechanism for Kubernetes multi-tenancy policies, this oversight creates a cross-namespace access path. The vulnerability is rooted in incomplete CWE-284 (Improper Access Control) and CWE-863 (Incorrect Authorization) patterns. Exploitation requires existing cluster authentication (authenticated user), but does not require elevated RBAC permissions, making it a privilege escalation within the cluster.

Business impact

In shared Kubernetes clusters, this vulnerability enables namespace-level privilege escalation. Authenticated users can exfiltrate sensitive data packaged in other namespaces—such as configuration, credentials, or compiled functions—without elevated cluster roles. For organizations running Fission as a multi-tenant platform or shared infrastructure, this can lead to data exposure across isolated development, testing, or customer workloads. The impact is confidentiality-focused; the attacker gains read access to packages they should not be able to reference.

Affected systems

Fission versions prior to 1.24.0 are affected. The vulnerability requires a deployed Fission control plane with admission webhook enforcement enabled and at least one Function resource defined. It impacts any Kubernetes cluster running vulnerable Fission releases where namespace isolation is a security boundary.

Exploitability

Exploitation requires prior authentication to the Kubernetes cluster and the ability to create or modify Fission Function resources (typically within a namespace). An attacker with standard user privileges can craft a Function spec with a cross-namespace PackageRef to retrieve packages from other namespaces. No authentication bypass, code execution, or external network access is required. The attack is straightforward for an insider or compromised service account with namespace-scoped permissions.

Remediation

Upgrade Fission to version 1.24.0 or later. This release adds PackageRef.Namespace validation to the admission webhook, enforcing the same namespace boundary checks applied to SecretRef and ConfigMapRef. Verify the upgrade is complete and the admission webhook is operational post-deployment.

Patch guidance

Upgrade Fission to version 1.24.0. Consult the official Fission release notes and deployment documentation for version-specific upgrade paths and any configuration changes. For Helm-based deployments, update the Fission Helm chart to a version that includes 1.24.0 or later. Ensure the admission webhook is enabled after upgrade by verifying ValidatingWebhookConfiguration and MutatingWebhookConfiguration resources are in place and healthy.

Detection guidance

Review Function resources across all namespaces for PackageRef fields that reference packages in different namespaces than the Function itself. Query the cluster with kubectl get functions -A -o yaml or equivalent to identify cross-namespace PackageRef usage. Monitor admission webhook logs for rejected requests (a sign that the patch is working) and audit API server logs for Function creation or modification events that involve unexpected namespace references. Look for patterns where service accounts or users are accessing packages outside their intended namespace.

Why prioritize this

With a CVSS score of 7.7 (HIGH), this vulnerability merits prompt remediation in multi-tenant environments. Kubernetes namespace isolation is a foundational security boundary; bypassing it exposes sensitive workload data. The low attack complexity and absence of elevated privileges required make exploitation accessible to insiders. While not yet in the CISA KEV catalog, any Fission deployment with namespace-isolated workloads should prioritize patching.

Risk score, explained

CVSS 3.1 score of 7.7 reflects a network-accessible vulnerability (AV:N), no special conditions required (AC:L), requiring only low privileges (PR:L). The attacker gains high confidentiality impact (C:H) by reading cross-namespace packages, with no integrity or availability impact. The scope is changed (S:C) because the attacker's actions affect resources outside their authority boundary. The absence of authentication bypass or code execution keeps the score below critical levels.

Frequently asked questions