CVE-2026-49824

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.24.0

Description Fission is an open-source, Kubernetes-native serverless framework used for deploying functions and applications on Kubernetes. The Function admission webhook in pkg/webhook/function.go fails to validate that the spec.environment.namespace variable matches the function's own namespace, although it correctly performs this check for spec.secrets[].namespace and spec.configmaps[].namespace. This allows for cross-namespace environment references via an unvalidated EnvironmentRef.

Recommendations Update to version 1.24.0.