Loading story…
Fission disclosed a high-severity flaw, tracked as CVE-2026-46614 and GHSA-3g33-6vg6-27m8, that exposed internal per-function routes on the same public router listener used for normal HTTPTrigger traffic. In affected versions up to 1.22.0, any party with network access to the router could call /fission-function/<name> or /fission-function/<ns>/<name> directly, even if no HTTPTrigger existed for that function. The behavior bypassed host, path, and method restrictions enforced by HTTPTrigger, potentially exposing unpublished functions, enabling function-name enumeration, and creating cross-tenant access risks in multi-tenant or internet-facing deployments.
Fission fixed the issue in version 1.23.0 by separating public and internal router listeners, moving direct function invocation to an internal ClusterIP-only service on port 8889, and adding HMAC-based authentication for internal requests. The remediation also updated internal components including kubewatcher, timer, Kafka consumers, KEDA scaler components, fetcher, builder, and executor to use signed requests, while tightening NetworkPolicy controls and adding tests to block public access to /fission-function/. Until upgraded, operators were advised to restrict router ingress, block /fission-function/ paths at the ingress layer, and avoid exposing the router directly through LoadBalancer or NodePort.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A CVE entry documented the Fission vulnerability as CVE-2026-46614, describing how versions before 1.23.0 allowed anyone with network access to the router to invoke functions by guessing function name and namespace. The entry notes the issue was fixed in Fission 1.23.0.
Fission disclosed that versions up to 1.22.0 exposed internal /fission-function routes on the public router listener, allowing direct invocation of functions without an HTTPTrigger and bypassing host, path, and method restrictions. The advisory states the issue was fixed in version 1.23.0 with separate public and internal listeners, HMAC-based verification, and internal access controls.
Fission merged the follow-on hardening work for GHSA-3g33-6vg6-27m8 into main, completing changes that split public and internal router listeners, moved direct function routes to internal port 8889, added HMAC authentication for internal requests, and tightened service and NetworkPolicy exposure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in the Kubernetes-native serverless platform **Fission** were disclosed, both allowing low-privileged tenants to inject unsafe `PodSpec` fields that can lead to **node escape** and broader **cluster compromise**. **CVE-2026-50563** affects the Container Executor path, where `Function.spec.podspec` could be merged into an executor-generated pod definition before a Deployment is created, while **CVE-2026-50545** affects the Environment CRD path through insufficient validation of `Environment.spec.runtime.podSpec` and `spec.builder.podSpec`. Both issues carry a CVSS v3.1 rating of `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`, reflecting low attack complexity and high impact to confidentiality, integrity, and availability. The flaws affect **Fission versions prior to 1.24.0**, and the project has released fixes in **version 1.24.0** alongside related GitHub advisories and pull requests. The disclosures indicate that unsafe passthrough and merge behavior in pod creation logic could let a tenant influence generated pods in ways that break isolation boundaries, turning serverless function deployment features into a path for host-level access and potential **cluster takeover**. Separately, a malicious Rust crate, **`onering` 1.4.1**, was also reported on the same day after being uploaded to crates.io with code designed to exfiltrate project metadata and source code before being removed roughly six hours later, though no evidence of actual use was reported.
Jun 29, 2026
Next.js disclosed a **critical remote code execution** vulnerability affecting applications that use the **App Router**, tracing the issue to the upstream React Server Components protocol as `CVE-2025-55182` and the downstream Next.js impact as `CVE-2025-66478`. The flaw carries a **CVSS 10.0** rating and can be triggered by attacker-controlled requests in unpatched environments, with maintainers warning that **no workaround exists**. Affected releases include multiple `15.x` and `16.x` branches and `14.3.0-canary.77` and later canary builds, while `13.x`, stable `14.x`, **Pages Router** applications, and the **Edge Runtime** were reported as unaffected. Next.js issued patched releases, published the `fix-react2shell-next` npm remediation tool, and advised organizations whose applications were online and unpatched at the disclosed cutoff to **rotate secrets after patching**. The company later reported two additional upstream React Server Components issues with downstream impact on Next.js App Router deployments: `CVE-2025-55184`, a **high-severity denial-of-service** flaw that can hang the server process through a crafted HTTP request, and `CVE-2025-55183`, a **medium-severity source code exposure** bug that can cause a Server Function to return compiled source code from other Server Functions. Next.js said neither new issue enables remote code execution and that the earlier React2Shell mitigation remains effective, but it also acknowledged that the initial fix for `CVE-2025-55184` was incomplete and was superseded by `CVE-2025-67779`, forcing some users to upgrade again. The affected range spans App Router deployments from `13.3` across several `14.x`, `15.x`, and `16.x` release lines, and the vendor again said **Pages Router** applications are not affected and urged immediate upgrades to the latest patched versions.
Jun 29, 2026
F5 disclosed multiple high-severity vulnerabilities affecting **NGINX Open Source**, **NGINX Plus**, and related products, including a critical heap-based buffer overflow in `ngx_http_proxy_v2_module` and `ngx_http_grpc_module` tracked as **CVE-2026-42055**. The flaw can be triggered remotely without authentication when HTTP/2 proxying or `grpc_pass` is enabled, `ignore_invalid_headers` is set to `off`, and `large_client_header_buffers` exceeds 2 MB, allowing oversized headers to crash worker processes and potentially enable code execution if ASLR is bypassed. F5 also disclosed **CVE-2026-42530**, a critical use-after-free in the open-source `ngx_http_v3_module` that can be exploited through a crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, again causing worker restarts and possible code execution. A separate issue, **CVE-2026-11311**, affects **NGINX Gateway Fabric** when **NGINX Plus** is used as the data plane, allowing authenticated users with permission to modify relevant CRDs to inject arbitrary NGINX directives through unsanitized values in `NginxProxy.serverTokens` and `AuthenticationFilter.extraAuthArgs`. F5's out-of-band advisory said the exposure spans a broad set of products, including **NGINX Ingress Controller**, **NGINX Instance Manager**, **NGINX App Protect WAF**, **NGINX App Protect DoS**, **F5 WAF for NGINX Instance Manager**, and **F5 DoS for NGINX**. Updated releases, including **nginx 1.31.2** and the stable branch **1.30.3**, were published to address the core NGINX flaws, and defenders were urged to patch affected versions or disable HTTP/3 QUIC where immediate updates are not possible.
Jun 29, 2026