Fission's storagesvc component provided the /v1/archive endpoint with full create, read, update, and delete functionality without performing any authentication or authorization. An unauthenticated caller—including any pod that can reach the storagesvc ClusterIP—could enumerate archive IDs, download archives belonging to other tenants, upload arbitrary archive content, or delete existing archives. This flaw is classified as an authentication failure (CWE‑306) and could be leveraged by an attacker to exfiltrate data or tamper with other users' functions.

Fission, the Kubernetes-native serverless framework, is affected. The storage service within Fission, specifically the storagesvc component, includes the vulnerable endpoint prior to version 1.23.0. All releases before 1.23.0 are susceptible, while version 1.23.0 and later contain patched handlers that enforce authentication and authorization.

The issue carries a CVSS score of 8.8, indicating a high severity vulnerability. Although EPSS data is not available, the direct nature of the flaw and the wide exposure of the API make it highly exploitable in a multi-tenant cluster where workloads can easily communicate with the storagesvc ClusterIP. Because no additional credentials or privileges are required, an attacker with network access inside the cluster can immediately enumerate, retrieve, modify, or delete archives, potentially compromising other tenants or disrupting services. The vulnerability is not listed in CISA's KEV catalog, but its high CVSS score warrants urgent attention.