fission vulnerabilities
17 published CVEs name fission among the affected products.
- Published CVEs
- 17
- Last 12 months
- 17
- Critical
- 5
- Known exploited
- 0
Critical 5High 8Medium 3Low 1Not scored 0
Newest CVEs
- CVE-2026-50570
Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption
fission · fission
High8.5 - CVE-2026-50569
Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks
fission · fission
Medium4.3 - CVE-2026-50568
Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
fission · fission
Low3.6 - CVE-2026-50567
Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory
fission · fission
High7.7 - CVE-2026-50566
Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation
fission · fission
Critical9.9 - CVE-2026-50565
Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container
fission · fission
Medium4.9 - CVE-2026-50564
Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape
fission · fission
Critical9.9 - CVE-2026-50563
Fission Container Executor Function PodSpec Injection Leading to Node Escape
fission · fission
Critical9.9 - CVE-2026-50545
Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover
fission · fission
Critical9.9 - CVE-2026-49824
Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook
fission · fission
High8.5