CVE-2026-46612

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission storagesvc component registers archive CRUD handlers (/v1/archive GET / POST / DELETE and /v1/archives list) directly on its HTTP router without performing any authentication or authorization. Any caller able to reach the storagesvc ClusterIP — including any other workload in the same Kubernetes cluster — could enumerate archive IDs, download archives belonging to other tenants, upload arbitrary archive content, and delete archives. This issue has been patched in version 1.23.0.

• CWE-306

• https://github.com/fission/fission/pull/3365
• https://github.com/fission/fission/pull/3368
• https://github.com/fission/fission/releases/tag/v1.23.0
• https://github.com/fission/fission/security/advisories/GHSA-chf8-4hv6-8pg6

Published

Jun 10, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46606Glances is an open-source system cross-platform monitoring t…7.8
• CVE-2026-46607Glances is an open-source system cross-platform monitoring t…7.8
• CVE-2026-46608Glances is an open-source system cross-platform monitoring t…7.4
• CVE-2026-46609Umbraco is an ASP.NET CMS. From version 14.0.0 to before ver…4.6
• CVE-2026-4661The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sal…7.5
• CVE-2026-46611Glances is an open-source system cross-platform monitoring t…5.3
• CVE-2026-46614Fission is an open-source, Kubernetes-native serverless fram…9.8
• CVE-2026-46616Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.…6.1
• CVE-2026-46617Fission is an open-source, Kubernetes-native serverless fram…8.7
• CVE-2026-46618Fission is an open-source, Kubernetes-native serverless fram…6.9
• CVE-2026-4662The JetEngine plugin for WordPress is vulnerable to SQL Inje…7.5
• CVE-2026-46620e107 is a content management system (CMS). Prior to 2.3.5, e…6.5