Vulnerability · Published Jun 10, 2026 · Assigned by GitHub_M
CVE-2026-46614Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger
Critical 9.8
In plain English
A critical-severity improper access control in fission from fission. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission router registers an internal-style route — /fission-function/<name> and /fission-function/<ns>/<name> — for every Function object, independent of whether any HTTPTrigger exists for that function. The route was mounted on the same listener as user-defined HTTPTriggers (svc/router, port 8888), so any caller who could reach the router could invoke any function by guessing its metadata.name (and namespace), bypassing the host / path / method / method-allow-list restrictions encoded in HTTPTrigger objects. This issue has been patched in version 1.23.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/fission/fission | 1.23.0 | GHSA-3g33-6vg6-27m8 |
| Go | github.com/fission/fission | 1.23.0 | GO-2026-5082 |
Affected products (as reported)
Weakness: CWE-284, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/fission/fission/security/advisories/GHSA-3g33-6vg6-27m8 x_refsource_CONFIRM
- https://github.com/fission/fission/pull/3365 x_refsource_MISC
- https://github.com/fission/fission/pull/3369 x_refsource_MISC
- https://github.com/fission/fission/releases/tag/v1.23.0 x_refsource_MISC