---
id: CVE-2026-49823
title: >-
  Fission: Cross-namespace Package read via unvalidated PackageRef in Function
  admission webhook
summary: >-
  Fission: Cross-namespace Package read via unvalidated PackageRef in Function
  admission webhook
severity: high
cvss: 7.7
cwe:
  - CWE-284
  - CWE-863
vendor: fission
product: github.com/fission/fission
ecosystem: go
affected:
  - github.com/fission/fission <= 1.23.0
patched:
  - github.com/fission/fission 1.24.0
published: '2026-06-30'
updated: '2026-06-30'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-3r8v-2xmj-5c39'
references:
  - url: 'https://github.com/fission/fission/security/advisories/GHSA-3r8v-2xmj-5c39'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49823'
  - url: 'https://github.com/fission/fission/pull/3389'
  - url: >-
      https://github.com/fission/fission/commit/80e7ba55228e1ef426f51353e25d2682ec61de34
  - url: 'https://github.com/fission/fission/releases/tag/v1.24.0'
  - url: 'https://github.com/advisories/GHSA-3r8v-2xmj-5c39'
tags:
  - ghsa
  - go
epss: 0.00437
epssPercentile: 0.35274
ingestedAt: '2026-06-30T21:24:14.412Z'
---

## Overview

### Summary

A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; `PackageRef.Namespace` was not.

### Details

A tenant with `functions.fission.io/create` in their own namespace could set `spec.package.packageref.namespace` to any other namespace. When the function is invoked, the fetcher sidecar reads the victim Package using the
`fission-fetcher` service account's namespace-wide `get packages` permission and writes its contents to `/userfunc/deployarchive` inside the attacker's pool pod, exposing the victim's source code and any embedded credentials.

The `fission-fetcher` SA holds `get packages` in every configured function namespace (granted by `charts/fission-all/templates/_function-access-role.tpl`), so the namespace check was the only barrier between the attacker and any
in-cluster Fission Package.

### Impact

A function author in one namespace could read the deployment archive — and therefore the source code and embedded secrets — of any Package in any other namespace.

### Fix

Fixed in [#3389](https://github.com/fission/fission/pull/3389) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0).

The admission webhook (`pkg/webhook/function.go::Validate`) rejects `Function.spec.package.packageref.namespace != metadata.namespace`. An empty namespace remains accepted (controllers default it to the function's namespace). This
shipped together with the EnvironmentRef cross-namespace check (GHSA-cvw6-gfvv-953q).

### Behavioural change

Functions that explicitly set `spec.package.packageref.namespace` to a different namespace are now rejected at admission.

## Affected packages

- `github.com/fission/fission <= 1.23.0`

## Remediation

Upgrade to a patched release:

- `github.com/fission/fission 1.24.0`