CVE-2026-50565

MEDIUM EPSS 16.8%

Published Jun 10, 20263w ago · Modified Jun 17, 20262w ago

4.9 CVSS 3.1

Medium

Published Jun 10, 2026 3w ago

Last Modified Jun 17, 2026 2w ago

Description

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission builder pods were created with ServiceAccountName: fission-builder and no AutomountServiceAccountToken: false, so the kubelet auto-mounted the service-account token into every container in the pod — including the user-supplied builder image. This issue has been patched in version 1.24.0.

CVSS Details

Base Score

4.9

Exploitability

1.2

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required High

User Interaction None

Scope Unchanged

Confidentiality High

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

16.8% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 3

CWE-250

CWE-269 Improper Privilege Management Authorization

CWE-538

References 3

github.com https://github.com/fission/fission/pull/3390
github.com https://github.com/fission/fission/releases/tag/v1.24.0
github.com https://github.com/fission/fission/security/advisories/GHSA-8wcj-mfrc-jx5q

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.