CVE-2026-49824 is a high-severity (CVSS 8.5) CWE-284 vulnerability in github.com/fission/fission. A fix is available for github.com/fission/fission — see the affected versions and patch details below.
Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-49824 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 379,842 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
github.com/fission/fissionReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The Fission Function admission webhook (pkg/webhook/function.go) validated that spec.secrets[].namespace and spec.configmaps[].namespace equalled the function's own namespace but performed no equivalent check on
spec.environment.namespace.
Details
An attacker with permission to create Functions in their own namespace could set spec.environment.namespace to any other tenant's namespace. poolmgr and newdeploy would then look up and use the victim's Environment CRD when scheduling
function pods, so the attacker's function executed inside the victim's container image.
This is useful both for code and credential theft — the victim's runtime image may contain hardcoded secrets — and for confused-deputy attacks where the victim's runtime image is a privileged sidecar.
Impact
A tenant with functions.fission.io/create could run their own function code inside another tenant's container image, breaking the namespace trust boundary that the Function specification implies.
Fix
Fixed in #3389 and released in v1.24.0.
- Admission webhook (
pkg/webhook/function.go::Validate) rejectsFunction.spec.environment.namespace != metadata.namespace. An empty namespace remains accepted (the CLI defaults it to the function's namespace). - Controller belt-and-braces: the same check runs before the cross-namespace
Environments(...).Getin poolmgrgetFunctionEnvand newdeployfnCreate/RefreshFuncPods, covering webhook-bypass clusters (failurePolicy=Ignore) and stale Function objects from upgrade-before-restart windows.
Behavioural change
Functions that explicitly set spec.environment.namespace to a different namespace are now rejected at admission. Empty-string remains accepted.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/fission/fission | all versions | 1.24.0go get github.com/fission/fission@v1.24.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/fission/fission, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/fission/fission to 1.24.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-49824 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is CVE-2026-49824 in your dependencies?
Find it across Go, including transitive dependencies.