Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; PackageRef.Namespace was not. This issue has been patched in version 1.24.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-11 | 1 | Patch1 |
| 2026-06-30 | 1 | Disclosure1 |
🔴 Fission, Cross-Namespace Package Read via Unvalidated PackageRef (#CVE-2026-49823), HIGH -DC-Jun2026-749 https://dailycve.com/fission-cross-namespace-package-read-via-unvalidated-packageref-cve-2026-49823-high-dc-jun2026-749/
Post summary
The post announces CVE‑2026‑49823, a high‑severity Fission vulnerability that allows cross‑namespace package reads through an unvalidated PackageRef.
CVE-2026-49823 - Supply Chain Attack in Fission. Unvalidated PackageRef.Namespace allows cross-namespace access. CVSS 7.7. Patch to 1.24.0 immediately. #CVE #Kubernetes #infosec #cybersecurity #devsecops #docker #devops #k8s More detailed info: https://www.valtersit.com/cve/CVE-2026-49823
Post summary
CVE-2026-49823 is a supply chain vulnerability in Fission that allows cross‑namespace access, rated CVSS 7.7; it is mitigated by upgrading to version 1.24.0.