Fission's KubernetesWatchTrigger feature allows a developer with limited cluster rights to create a trigger in their own namespace. The trigger can subscribe to and receive events from any other namespace, effectively providing a persistent surveillance channel. This cross‑namespace event leakage enables unauthorized access to data and state changes that the developer should not observe, an information disclosure vulnerability classified as CWE‑284 (Improper Access Control) and CWE‑862 (Missing Authorization Check).

All users of the open‑source Fission serverless framework prior to version 1.24.0 are affected. The vendor is Fission (fission:fission) and the patch was released in the 1.24.0 release. Earlier releases—including any minor or patch versions before 1.24.0—do not include the fix.

The CVSS score of 7.7 indicates a high impact risk for systems that use Fission. Because the exploitation requires only the ability to create a KubernetesWatchTrigger—which is typically granted to developers—an attacker inside a Kubernetes cluster can leverage this easily. EPSS data is not available, and the vulnerability is not listed in CISA KEV, but the lack of credential or privilege escalation does not reduce the likelihood of exploitation in environments with permissive developer access.