RCE in Fission
CVE-2026-46618
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, before the round-1 security sweep, pkg/builder/builder.go passed Environ…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.004 (29.0th percentile) — read the EPSS interpretation.
Affected products
- Fission — versions < 1.23.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)