The vulnerability in Fission's KubernetesWatchTrigger component involved two main flaws: first, the createKubernetesWatch function used the user-controlled spec.namespace directly as the watch target without verifying it matched the trigger's own namespace, allowing cross-namespace event watching. Second, the validating webhook only checked create operations, letting update and patch requests bypass validation. Additionally, an empty spec.namespace defaulted to watching all namespaces. Together, these flaws enabled a tenant with create permission on KubernetesWatchTriggers to establish a persistent surveillance channel over any namespace, receiving full JSON event payloads for Pods, Services, and Jobs. The issue was resolved in pull request #3379 and released in Fission v1.24.0 by extending webhook validation to update verbs, rejecting triggers where spec.namespace differs from metadata.namespace, and coercing empty spec.namespace to the trigger's own namespace.

An attacker with permission to create KubernetesWatchTriggers in their own namespace could continuously monitor and receive detailed event data for Pods, Services, and Jobs across all namespaces in the cluster. This creates a persistent cross-tenant surveillance channel without requiring additional privileges, potentially exposing sensitive operational information about other tenants' workloads. The vulnerability does not allow modification or denial of service but compromises confidentiality.

This vulnerability is fixed in Fission version 1.24.0. Users should upgrade to v1.24.0 or later to apply the official fix. The fix includes enhanced webhook validation for create and update operations, strict enforcement that spec.namespace matches the trigger's namespace, and defaulting empty spec.namespace to the trigger's own namespace. No additional mitigation is required once upgraded. For users relying on the previous behavior where an unset spec.namespace watched all namespaces, separate KubernetesWatchTriggers per namespace must now be created.