CVE-2026-46614

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission router registers an internal-style route — /fission-function/<name> and /fission-function/<ns>/<name> — for every Function object, independent of whether any HTTPTrigger exists for that function. The route was mounted on the same listener as user-defined HTTPTriggers (svc/router, port 8888), so any caller who could reach the router could invoke any function by guessing its metadata.name (and namespace), bypassing the host / path / method / method-allow-list restrictions encoded in HTTPTrigger objects. This issue has been patched in version 1.23.0.

• CWE-284
• CWE-862

• https://github.com/fission/fission/pull/3365
• https://github.com/fission/fission/pull/3369
• https://github.com/fission/fission/releases/tag/v1.23.0
• https://github.com/fission/fission/security/advisories/GHSA-3g33-6vg6-27m8

Published

Jun 10, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46607Glances is an open-source system cross-platform monitoring t…7.8
• CVE-2026-46608Glances is an open-source system cross-platform monitoring t…7.4
• CVE-2026-46609Umbraco is an ASP.NET CMS. From version 14.0.0 to before ver…4.6
• CVE-2026-4661The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sal…7.5
• CVE-2026-46611Glances is an open-source system cross-platform monitoring t…5.3
• CVE-2026-46612Fission is an open-source, Kubernetes-native serverless fram…8.8
• CVE-2026-46616Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.…6.1
• CVE-2026-46617Fission is an open-source, Kubernetes-native serverless fram…8.7
• CVE-2026-46618Fission is an open-source, Kubernetes-native serverless fram…6.9
• CVE-2026-4662The JetEngine plugin for WordPress is vulnerable to SQL Inje…7.5
• CVE-2026-46620e107 is a content management system (CMS). Prior to 2.3.5, e…6.5
• CVE-2026-46621Yamcs is a mission control framework. Prior to 5.12.7, the Y…9.1