CVE-2026-49824: Fission Kubernetes Admission Webhook Namespace Validation Bypass (CVSS 8.5)

Technical summary

The vulnerability exists in pkg/webhook/function.go where the Fission Function admission webhook implements namespace isolation for function dependencies. The webhook validates spec.secrets[].namespace and spec.configmaps[].namespace against the function's declared namespace, but omits an equivalent validation for spec.environment.namespace. An authenticated user with permission to create or modify Fission Functions can specify an environment object from a different namespace, bypassing the intended namespace boundary. Environments in Fission define the runtime container, libraries, and configuration for function execution; unauthorized environment access could allow an attacker to inject malicious code or configurations into function execution contexts. This is classified as an Improper Access Control vulnerability (CWE-284, CWE-863).

Business impact

In shared Kubernetes clusters where multiple teams or customers deploy functions via Fission, this vulnerability enables lateral movement and privilege escalation. A user with function creation rights in one namespace could reference a privileged or adversary-controlled environment from another namespace, potentially executing code with elevated permissions or accessing sensitive data attached to that environment. Organizations relying on namespace-based multi-tenancy for billing, compliance, or security isolation are at risk of data exfiltration, unauthorized code execution, and compliance violations. The impact is amplified in environments where functions handle sensitive workloads or where strict isolation between tenants is a contractual requirement.

Affected systems

Fission versions prior to 1.24.0 are affected. This includes all deployments running Fission as a serverless platform on Kubernetes. The vulnerability requires authentication (an actor must have valid credentials and permissions to create or modify Functions within their own namespace), so public or internet-exposed Fission clusters are higher-risk than private installations. Organizations using Fission for production workloads, particularly those with multi-tenant deployments, should prioritize assessment and patching.

Exploitability

Exploitation requires authentication and function creation/modification permissions, placing this in the 'authenticated attacker' category. In most deployments, any user or service account with API access to create Functions can trigger the vulnerability—a relatively low bar in Kubernetes RBAC models where multiple teams share a cluster. No unusual interaction patterns or social engineering is needed; a direct API call specifying a cross-namespace environment reference suffices. The attack surface is internal to the cluster and accessible to authenticated parties only, but the CVSS 3.1 score of 8.5 reflects the high impact (confidentiality) and broad scope (environment affecting other resources).

Remediation

Upgrade Fission to version 1.24.0 or later, which patches the admission webhook to enforce namespace validation on spec.environment.namespace parity with Secrets and ConfigMaps. This ensures that Functions can only reference environments in their own namespace. Verify the patch is applied by reviewing the function webhook configuration post-upgrade. No configuration changes or workarounds are provided for versions below 1.24.0; patching is the definitive remediation.

Patch guidance

Fission maintainers have released version 1.24.0 with a fix. Update your Fission deployment using the standard Helm chart or container image release for version 1.24.0 or any subsequent patch version. Test the upgrade in a development or staging cluster first to ensure backward compatibility with existing function definitions. If any functions currently reference cross-namespace environments (indicating potential prior exploitation), audit those functions and their execution history before production rollout. Consult the Fission project release notes and security advisories for complete upgrade instructions.

Detection guidance

Monitor Kubernetes audit logs for Function API calls (create, update, patch) that specify spec.environment.namespace values differing from the function's own namespace. Tools like Falco or Kubernetes audit event processors can flag these anomalies. On running clusters, audit existing Function objects for cross-namespace environment references using kubectl queries (e.g., 'kubectl get functions -A -o json | jq'). Implement admission webhooks or policy engines (e.g., Kyverno, OPA) to prevent such configurations even before patching, if immediate remediation is not feasible. Review function execution logs and environment variable injections to detect if cross-namespace references were previously exploited.

Why prioritize this

This vulnerability warrants HIGH priority due to its authentication-only requirement, potential for lateral movement in multi-tenant clusters, and confidentiality impact (HIGH per CVSS). Organizations operating Kubernetes clusters with multiple teams or customers should patch immediately. It is not listed on CISA's KEV catalog, so exploit code is not yet known to be actively circulating, but the conceptual attack is straightforward and could be weaponized by malicious insiders or discovered by adversaries. The blast radius widens in clusters where namespaces are actively used as security or tenancy boundaries.

Risk score, explained

CVSS 3.1 score of 8.5 (HIGH): Network-accessible attack vector (AV:N) with low complexity (AC:L) and low privilege requirement (PR:L) reflect the Kubernetes API exposure and function creation permissions common in cluster deployments. High confidentiality impact (C:H) reflects the risk of accessing privileged environments and their associated credentials or configuration. Low integrity impact (I:L) accounts for potential configuration modification. Changed Scope (S:C) indicates the vulnerability affects resources (environments) beyond the immediate function object. Availability is unaffected (A:N). The score appropriately penalizes the ease of exploitation balanced against the need for prior authentication.

Frequently asked questions