Threats tagged 'ghsa-gc3j-79f2-7vvw'

A vulnerability in Fission's KubernetesWatchTrigger (KWT) allowed a low-privilege developer to create triggers in their own namespace that could watch events across all namespaces, enabling persistent cross-namespace surveillance. The issue arose from improper validation of the spec.namespace field and insufficient webhook validation on update operations. This allowed attackers to receive full event payloads for Pods, Services, and Jobs cluster-wide without additional privileges. The vulnerability was fixed in version 1.24.0 by enforcing namespace validation and extending webhook checks.