Fission is a Kubernetes‑native serverless framework. Prior to version 1.24.0 the admission webhook validates namespace for Secret and ConfigMap references but not for Package references. An attacker can craft a Function spec with a PackageRef that points to a namespace they do not own, enabling the Function pod to read data stored in that namespace. This flaw can lead to information disclosure and possible privilege escalation. The weakness is classified as CWE‑284 and CWE‑863.

The vulnerability affects all releases of the open‑source Fission framework prior to version 1.24.0, including the 1.23.x series and earlier. Users running those versions in a multi‑namespace Kubernetes cluster are impacted.

The CVSS score of 7.7 indicates a high severity flaw. Because the admission webhook processes Function objects submitted by cluster users, it is inferred that an attacker with permission to create or modify Functions could exploit the vulnerability. The EPSS score is not available and the flaw is not yet listed in the CISA KEV catalog, but the lack of namespace validation enables the attacker to read data across namespaces once the Function is deployed.