CVE-2026-46617: Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read

Synopsis

This is a Kubernetes service account token exposure in Fission, the open-source serverless framework for Kubernetes. The vulnerability is reachable over the network with no authentication required, because user-supplied function code runs inside a runtime pod that automounts the fission-fetcher service account token, giving that code direct access to the Kubernetes API with namespace-wide privileges. Successful exploitation allows an attacker to read any secret or configmap in the function namespace, far beyond what the function specification permits. A patched-image rebuild at version 1.23.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The function endpoint is exposed over the network, so an attacker can deliver malicious function code by invoking or deploying a function remotely without requiring local or adjacent-network access.

• AuthenticationNot required

  No credentials are needed to exploit this vulnerability; the fission-fetcher token is automounted unconditionally into every runtime pod regardless of who submitted the function.

• Victim interactionNot required

  No user or administrator action is needed after function deployment; the token is available to function code immediately at runtime without any additional trigger.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: the token path is fixed and predictable, and no race conditions or special memory layout requirements exist.

Blast Radius

• Reads any Kubernetes Secret in the function namespace, including database passwords, API keys, and TLS certificates stored there.
• Reads any ConfigMap in the function namespace, including environment-specific configuration that may contain internal service endpoints or feature flags.
• Bypasses the Function.spec.secrets allowlist entirely, so access is not limited to secrets the function owner explicitly declared.
• Enables lateral movement within the namespace by using harvested credentials to authenticate to other services or APIs reachable from that namespace.