The vulnerability occurs when Fission builder pods created before version 1.24.0 automatically mount the fission‑builder ServiceAccount token into every container, including user‑supplied builder images. This exposes credentials that let the builder container authenticate to the Kubernetes API with the fission‑builder ServiceAccount, potentially granting unauthorized privilege escalation. The issue aligns with CWE‑250, CWE‑269, and CWE‑538.

Any deployment of Fission older than v1.24.0 is affected. The product is the Fission serverless framework, and any instance running a version prior to 1.24.0 may allow this token leakage.

The CVSS score of 4.9 rates the vulnerability as moderate, and no EPSS score is available, indicating a lack of publicly documented exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must be able to control or influence the builder pod environment, which is generally limited to users who can deploy or modify functions. The risk is therefore moderate, and applying the patch that removes token auto‑mounting is the recommended mitigation.