| id: GO-2026-5846 | |
| modules: | |
| - module: github.com/fission/fission | |
| versions: | |
| - fixed: 1.24.0 | |
| vulnerable_at: 1.23.0 | |
| summary: |- | |
| Fission: Cross-namespace Package read via unvalidated PackageRef in Function | |
| admission webhook in github.com/fission/fission | |
| cves: | |
| - CVE-2026-49823 | |
| ghsas: | |
| - GHSA-3r8v-2xmj-5c39 | |
| references: | |
| - advisory: https://github.com/fission/fission/security/advisories/GHSA-3r8v-2xmj-5c39 | |
| - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-49823 | |
| - fix: https://github.com/fission/fission/commit/80e7ba55228e1ef426f51353e25d2682ec61de34 | |
| - fix: https://github.com/fission/fission/pull/3389 | |
| - web: https://github.com/fission/fission/releases/tag/v1.24.0 | |
| source: | |
| id: GHSA-3r8v-2xmj-5c39 | |
| created: 2026-07-06T17:44:57.988251001-04:00 | |
| review_status: UNREVIEWED |