CVE-2026-49824

8.5 Élevée

Publiée le 10/06/2026 à 20:17 · Modifiée le 17/06/2026 à 12:55 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Fission Function admission webhook (pkg/webhook/function.go) validated that spec.secrets[].namespace and spec.configmaps[].namespace equalled the function's own namespace but performed no equivalent check on spec.environment.namespace. This issue has been patched in version 1.24.0.

Traduire en français

Produits concernés

fission

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N`

Faiblesses (CWE)

CWE-284
CWE-863

Références

https://github.com/fission/fission/pull/3389
https://github.com/fission/fission/releases/tag/v1.24.0
https://github.com/fission/fission/security/advisories/GHSA-cvw6-gfvv-953q

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories