Threats tagged 'ghsa-8wcj-mfrc-jx5q'

Fission builder pods prior to version 1.24.0 automatically mounted the fission-builder ServiceAccount token into user-supplied builder containers. This allowed code running in these containers to inherit the fission-builder identity, which has namespace-wide read access to Secrets and ConfigMaps in the builder namespace. The vulnerability enables subjects with create or update permissions on Environment CRDs to read all Secrets and ConfigMaps in the builder namespace. The issue was fixed in version 1.24.0 by disabling automatic token mounting on the user builder container and restricting token access to a dedicated fetcher sidecar.