Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission router registers an internal-style route — /fission-function/<name> and /fission-function/<ns>/<name> — for every Function object, independent of whether any HTTPTrigger exists for that function. The route was mounted on the same listener as user-defined HTTPTriggers (svc/router, port 8888), so any caller who could reach the router could invoke any function by guessing its metadata.name (and namespace), bypassing the host / path / method / method-allow-list restrictions encoded in HTTPTrigger objects. This issue has been patched in version 1.23.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-27 | 1 | Patch1 |
| 2026-05-29 | 1 | Disclosure1 |
KubernetesのFaaSフレームワーク「Fission」ルーターに深刻な脆弱性 CVE-2026-46614 https://rocket-boys.co.jp/security-measures-lab/kubernetes-fission-router-authentication-bypass-cve-2026-46614/ #セキュリティ対策Lab #security #securitynews
Post summary
A severe authentication bypass vulnerability (CVE-2026-46614) has been disclosed for Fission routers, but no PoC, active exploitation, or patch details are provided.
A critical Fission router vulnerability (CVE-2026-46614) allows unauthenticated function invocation in Kubernetes. Learn how to patch it now. #Kubernetes #Serverless #Fission #CloudSecurity #VulnerabilityPatch https://securityonline.info/fission-router-vulnerability-patched/ https://t.co/BPVbJD2nIq
Post summary
The tweet announces a critical Fission router vulnerability (CVE-2026-46614) that permits unauthenticated function invocation in Kubernetes, urging users to apply the available patch.