GHSA-8wcj-mfrc-jx5q: Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container
Fission builder pods prior to version 1.24.0 automatically mounted the fission-builder ServiceAccount token into user-supplied builder containers. This allowed code running in these containers to inherit the fission-builder identity, which has namespace-wide read access to Secrets and ConfigMaps in the builder namespace. The vulnerability enables subjects with create or update permissions on Environment CRDs to read all Secrets and ConfigMaps in the builder namespace. The issue was fixed in version 1.24.0 by disabling automatic token mounting on the user builder container and restricting token access to a dedicated fetcher sidecar.
AI Analysis
Technical Summary
Fission builder pods were created with the ServiceAccountName set to fission-builder but without disabling automatic ServiceAccount token mounting. Consequently, the kubelet auto-mounted the fission-builder token into every container in the pod, including user-supplied builder containers. Since the fission-builder ServiceAccount has namespace-wide get permissions on Secrets and ConfigMaps, any code running in the user builder container could read all Secrets and ConfigMaps in the builder namespace by accessing the token at the standard path. The vulnerability affects versions prior to 1.24.0 and was addressed by setting AutomountServiceAccountToken=false on the pod spec and mounting the token only in a fetcher sidecar container.
Potential Impact
An attacker or user with create or update permissions on Environment CRDs in a namespace observed by the builder manager can read all Secrets and ConfigMaps in the builder namespace. This could lead to unauthorized disclosure of sensitive information stored in Kubernetes Secrets and ConfigMaps within that namespace. There is no impact on integrity or availability reported.
Mitigation Recommendations
This vulnerability is fixed in Fission version 1.24.0. Users should upgrade to version 1.24.0 or later. The fix disables automatic mounting of the ServiceAccount token in user-supplied builder containers and restricts token access to a dedicated fetcher sidecar. Patch status is confirmed fixed in v1.24.0. No additional mitigation is required if running this or a later version.
GHSA-8wcj-mfrc-jx5q: Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container
Description
Fission builder pods prior to version 1.24.0 automatically mounted the fission-builder ServiceAccount token into user-supplied builder containers. This allowed code running in these containers to inherit the fission-builder identity, which has namespace-wide read access to Secrets and ConfigMaps in the builder namespace. The vulnerability enables subjects with create or update permissions on Environment CRDs to read all Secrets and ConfigMaps in the builder namespace. The issue was fixed in version 1.24.0 by disabling automatic token mounting on the user builder container and restricting token access to a dedicated fetcher sidecar.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Fission builder pods were created with the ServiceAccountName set to fission-builder but without disabling automatic ServiceAccount token mounting. Consequently, the kubelet auto-mounted the fission-builder token into every container in the pod, including user-supplied builder containers. Since the fission-builder ServiceAccount has namespace-wide get permissions on Secrets and ConfigMaps, any code running in the user builder container could read all Secrets and ConfigMaps in the builder namespace by accessing the token at the standard path. The vulnerability affects versions prior to 1.24.0 and was addressed by setting AutomountServiceAccountToken=false on the pod spec and mounting the token only in a fetcher sidecar container.
Potential Impact
An attacker or user with create or update permissions on Environment CRDs in a namespace observed by the builder manager can read all Secrets and ConfigMaps in the builder namespace. This could lead to unauthorized disclosure of sensitive information stored in Kubernetes Secrets and ConfigMaps within that namespace. There is no impact on integrity or availability reported.
Mitigation Recommendations
This vulnerability is fixed in Fission version 1.24.0. Users should upgrade to version 1.24.0 or later. The fix disables automatic mounting of the ServiceAccount token in user-supplied builder containers and restricts token access to a dedicated fetcher sidecar. Patch status is confirmed fixed in v1.24.0. No additional mitigation is required if running this or a later version.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8wcj-mfrc-jx5q
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-50565"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4452e827e9c797198e192c
Added to database: 06/30/2026, 23:36:08 UTC
Last enriched: 06/30/2026, 23:50:50 UTC
Last updated: 07/01/2026, 03:34:11 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.