CVE-2026-46617— Fission 安全漏洞

Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, Fission runtime pods were created with ServiceAccountName: fission-fetcher, and the fission-fetcher ServiceAccount was granted namespace-wide get on secrets and configmaps (it needs that to load function code, env vars, and config). The runtime pod's automounted token was reachable from inside the user's function container at /var/run/secrets/kubernetes.io/serviceaccount/token, so user-supplied function code inherited the same Kubernetes API privileges and could read any secret or configmap in the function's namespace — far beyond the Function.spec.secrets allowlist that the function specification suggests. This issue has been patched in version 1.23.0.

N/A

带着不必要的权限执行

Fission 安全漏洞

Fission是Fission开源的一个基于Kubernetes的函数部署框架。 Fission 1.23.0之前版本存在安全漏洞，该漏洞源于运行时Pod使用fission-fetcher ServiceAccount并自动挂载令牌，用户函数代码可读取命名空间中任何密钥或配置映射。

N/A

N/A