### Summary A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; `PackageRef.Namespace` was not. ### Details A tenant with `functions.fission.io/create` in their own namespace could set `spec.package.packageref.namespace` to any other namespace. When the function is invoked, the fetcher sidecar reads the victim Package using the `fission-fetcher` service account's namespace-wide `get packages` permission and writes its contents to `/userfunc/deployarchive` inside the attacker's pool pod, exposing the victim's source code and any embedded credentials. The `fission-fetcher` SA holds `get packages` in every configured function namespace (granted by `charts/fission-all/templates/_function-access-role.tpl`), so the namespace check was the only barrier between the attacker and any in-cluster Fission Package. ### Impact A function author in one namespace could read the deployment archive — and therefore the source code and embedded secrets — of any Package in any other namespace. ### Fix Fixed in [#3389](https://github.com/fission/fission/pull/3389) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0). The admission webhook (`pkg/webhook/function.go::Validate`) rejects `Function.spec.package.packageref.namespace != metadata.namespace`. An empty namespace remains accepted (controllers default it to the function's namespace). This shipped together with the EnvironmentRef cross-namespace check (GHSA-cvw6-gfvv-953q). ### Behavioural change Functions that explicitly set `spec.package.packageref.namespace` to a different namespace are now rejected at admission.
### Summary A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; `PackageRef.Namespace` was not. ### Details A tenant with `functions.fission.io/create` in their own namespace could set `spec.package.packageref.namespace` to any other namespace. When the function is invoked, the fetcher sidecar reads the victim Package using the `fission-fetcher` service account's namespace-wide `get packages` permission and writes its contents to `/userfunc/deployarchive` inside the attacker's pool pod, exposing the victim's source code and any embedded credentials. The `fission-fetcher` SA holds `get packages` in every configured function namespace (granted by `charts/fission-all/templates/_function-access-role.tpl`), so the namespace check was the only barrier between the attacker and any in-cluster Fission Package. ### Impact A function author in one namespace could read the deployment archive — and therefore the source code and embedded secrets — of any Package in any other namespace. ### Fix Fixed in [#3389](https://github.com/fission/fission/pull/3389) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0). The admission webhook (`pkg/webhook/function.go::Validate`) rejects `Function.spec.package.packageref.namespace != metadata.namespace`. An empty namespace remains accepted (controllers default it to the function's namespace). This shipped together with the EnvironmentRef cross-namespace check (GHSA-cvw6-gfvv-953q). ### Behavioural change Functions that explicitly set `spec.package.packageref.namespace` to a different namespace are now rejected at admission.
Update github.com/fission/fission to 1.24.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanFission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook affects github.com/fission/fission (go). Severity is high. ### Summary A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; `PackageRef.Namespace` was not. ### Details A tenant with `functions.fission.io/create` in their own namespace could set `spec.package.packageref.namespace` to any other namespace. When the function is invoked, the fetcher sidecar reads the victim Package using the `fission-fetcher` service account's namespace-wide `get packages` permission and writes its contents to `/userfunc/deployarchive` inside the attacker's pool pod, exposing the victim's source code and any embedded credentials. The `fission-fetcher` SA holds `get packages` in every configured function namespace (granted by `charts/fission-all/templates/_function-access-role.tpl`), so the namespace check was the only barrier between the attacker and any in-cluster Fission Package. ### Impact A function author in one namespace could read the deployment archive — and therefore the source code and embedded secrets — of any Package in any other namespace. ### Fix Fixed in [#3389](https://github.com/fission/fission/pull/3389) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0). The admission webhook (`pkg/webhook/function.go::Validate`) rejects `Function.spec.package.packageref.namespace != metadata.namespace`. An empty namespace remains accepted (controllers default it to the function's namespace). This shipped together with the EnvironmentRef cross-namespace check (GHSA-cvw6-gfvv-953q). ### Behavioural change Functions that explicitly set `spec.package.packageref.namespace` to a different namespace are now rejected at admission.
AI coding agents often install or upgrade packages automatically in go. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/fission/fissiongo | <=1.23.0 | 1.24.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate github.com/fission/fission to 1.24.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanFission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook affects github.com/fission/fission (go). Severity is high. ### Summary A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; `PackageRef.Namespace` was not. ### Details A tenant with `functions.fission.io/create` in their own namespace could set `spec.package.packageref.namespace` to any other namespace. When the function is invoked, the fetcher sidecar reads the victim Package using the `fission-fetcher` service account's namespace-wide `get packages` permission and writes its contents to `/userfunc/deployarchive` inside the attacker's pool pod, exposing the victim's source code and any embedded credentials. The `fission-fetcher` SA holds `get packages` in every configured function namespace (granted by `charts/fission-all/templates/_function-access-role.tpl`), so the namespace check was the only barrier between the attacker and any in-cluster Fission Package. ### Impact A function author in one namespace could read the deployment archive — and therefore the source code and embedded secrets — of any Package in any other namespace. ### Fix Fixed in [#3389](https://github.com/fission/fission/pull/3389) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0). The admission webhook (`pkg/webhook/function.go::Validate`) rejects `Function.spec.package.packageref.namespace != metadata.namespace`. An empty namespace remains accepted (controllers default it to the function's namespace). This shipped together with the EnvironmentRef cross-namespace check (GHSA-cvw6-gfvv-953q). ### Behavioural change Functions that explicitly set `spec.package.packageref.namespace` to a different namespace are now rejected at admission.
AI coding agents often install or upgrade packages automatically in go. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/fission/fissiongo | <=1.23.0 | 1.24.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard