CVE-2026-46618 Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables
Attackers with Environment CRD access can inject arbitrary commands into Fission builder pods, leading to remote code execution and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46618?
CVE-2026-46618 is a medium-severity command injection vulnerability in fission, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, before the round-1 security sweep, pkg/builder/builder.go passed Environment.spec.builder.command directly into exec.Command(...) after a strings.Fields split, with no validation of the executable path or its arguments. A user who could create or update Environment CRDs in a namespace observed by the buildermgr could thereby point the builder pod at any executable inside the builder image (e.g. /bin/sh -c '...') and execute arbitrary code in the builder pod context. This issue has been patched in version 1.23.0.
Which versions are affected by CVE-2026-46618?
3 open source packages ship an affected version, including github.com/fission/fission.
| Package | Affected | Fixed in |
|---|---|---|
github.com/fission/fission Go | All versions | 1.23.0 |
github.com/fission/fission Go | All versions | 1.23.0 |
github.com/fission/fission Go | All versions | 1.23.0 |
How do I fix CVE-2026-46618?
Upgrade github.com/fission/fission to 1.23.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-46618 being exploited?
There is no known exploitation of CVE-2026-46618 in the wild and no public exploit code.
Sources
Also known as GHSA-7pjr-qpvh-m339, GO-2026-5230.