CVE-2026-50565

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission builder pods were created with ServiceAccountName: fission-builder and no AutomountServiceAccountToken: false, so the kubelet auto-mounted the service-account token into every container in the pod — including the user-supplied builder image. This issue has been patched in version 1.24.0.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-250CWE-269CWE-538

Affected software

VendorProductVersions
fissionfission< 1.24.0

References

Timeline

Published
Jun 10, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-505669.9Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-505677.7Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-505683.6Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-505694.3Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-50577.5ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a deniaCVE-2026-505708.5Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on KubernetesCVE-2026-505715.7WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protCVE-2026-505725.9Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy'sCVE-2026-505738.1pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detectCVE-2026-505749.6yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest CVE-2026-505757.7BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowCVE-2026-505766.8ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Pri