Skip to content
CVE PROGRAM SOURCE RECORD4.9 Medium

CVE-2026-50565

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

Description

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission builder pods were created with ServiceAccountName: fission-builder and no AutomountServiceAccountToken: false, so the kubelet auto-mounted the service-account token into every container in the pod — including the user-supplied builder image. This issue has been patched in version 1.24.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

fission fission

  • < 1.24.0affected

References