CVE-2026-49821

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.24.0

Description Fission is an open-source, Kubernetes-native serverless framework used for deploying functions and applications on Kubernetes. The buildermgr controller processes Package Custom Resource Definitions (CRDs) without verifying that the Package.spec.environment.namespace matches the Package.metadata.namespace. This lack of validation allows for cross-namespace environment references, which can lead to command execution during build time and the exfiltration of Service Account (SA) tokens.

Recommendations Update to version 1.24.0.