The Fission Function admission webhook did not validate that the spec.environment.namespace field matched the function's own namespace, unlike similar checks for secrets and configmaps namespaces. An attacker with create permissions in their namespace could set spec.environment.namespace to another tenant's namespace, causing the system components poolmgr and newdeploy to use the victim's Environment CRD when scheduling function pods. This results in the attacker's function executing inside the victim's container image, breaking namespace isolation and enabling potential code and credential theft or confused-deputy attacks. The vulnerability is addressed in pull request #3389 and fixed in Fission v1.24.0 by rejecting Functions where spec.environment.namespace differs from the function's namespace at admission and controller levels.

A tenant with functions.fission.io/create permission can run arbitrary function code inside another tenant's container image, violating namespace isolation. This can lead to theft of code and credentials embedded in the victim's runtime image or enable confused-deputy attacks if the victim's runtime image has privileged sidecars. The vulnerability compromises confidentiality and integrity within multi-tenant Fission environments.

A fix is available in Fission version 1.24.0. The admission webhook now rejects Functions where spec.environment.namespace does not match the function's namespace, except when empty (which defaults to the function's namespace). Additionally, controller components perform the same validation to cover webhook bypass scenarios and stale objects. Users should upgrade to v1.24.0 or later to remediate this vulnerability.