PT-2026-42684 · Fission · Fission
CVE-2026-46612
·
Published
2026-05-21
·
Updated
2026-07-30
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Fission versions prior to 1.23.0
Description
The
storagesvc component registers archive CRUD handlers on its HTTP router without authentication or authorization. This allows any caller capable of reaching the storagesvc ClusterIP, such as other workloads within the same Kubernetes cluster, to enumerate archive IDs, download archives from other tenants, upload arbitrary content, and delete archives. This issue occurs because the handlers in pkg/storagesvc/storagesvc.go are mounted without authentication middleware. Affected endpoints include '/v1/archive' (GET, POST, DELETE) and '/v1/archives' (list).Recommendations
Update to version 1.23.0.
Enable the Helm chart's per-service NetworkPolicy by setting
networkPolicy.enabled=true.
Restrict storagesvc egress and ingress to only the executor, builder, and fetcher pods.
Avoid running untrusted workloads in the cluster that hosts Fission.Exploit
Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fission