PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46618 fission CVE debrief

CVE-2026-46618 is a security vulnerability in Fission, an open-source, Kubernetes-native serverless framework. Prior to version 1.23.0, the `pkg/builder/builder.go` file passed `Environment.spec.builder.command` directly into `exec.Command(...)` after a `strings.Fields` split, without validating the executable path or its arguments. This allows a user who can create or update Environment CRDs in a namespace observed by the `buildermgr` to execute arbitrary code in the builder pod context by pointing the builder pod at any executable inside the builder image. The issue has been patched in version 1.23.0.

Vendor
fission
Product
Unknown
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-10
Advisory published
2026-06-10
Advisory updated
2026-06-10

Who should care

Users of Fission prior to version 1.23.0 who create or update Environment CRDs in namespaces observed by the builder manager should be aware of this vulnerability.

Technical summary

The vulnerability arises from the lack of validation of executable paths and arguments in `pkg/builder/builder.go`. Specifically, the code passes `Environment.spec.builder.command` directly to `exec.Command(...)` after splitting it using `strings.Fields`, without ensuring the command is safe to execute. This allows an attacker to potentially execute arbitrary code within the builder pod by manipulating the `Environment.spec.builder.command` field.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update to Fission version 1.23.0 or later to apply the patch.
  • Restrict access to create or update Environment CRDs in namespaces observed by the builder manager.
  • Monitor builder pod activity for suspicious commands.

Evidence notes

The CVE has a CVSS score of 6.9 and is classified as MEDIUM severity. The vulnerability was patched in version 1.23.0 of Fission.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46618 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46618

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46618 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46618

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.