# Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger

Fission router exposed /fission-function/<ns>/<name> on its public listener, letting any caller invoke functions lacking an HTTPTrigger and bypass trigger restrictions.

- Payout: Research
- Severity: critical
- Program: Fission
- Found by: FORIMOC, nnin-nnin
- Disclosed: 2026-05-21
- CVE: CVE-2026-46614
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-3g33-6vg6-27m8
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-3g33-6vg6-27m8
- Tags: area:cloud domain:api domain:cloud impact:internal-access impact:privesc kind:research platform:ghsa sev:critical tech:go tech:kubernetes technique:source-review vuln:access-control vuln:auth-bypass

**Target:** Kubernetes serverless router HTTP listener (svc/router:8888)
**Root cause:** The router registered the internal-style /fission-function/<ns>/<name> route for every Function object on the same public listener that serves user HTTPTriggers, so internal trigger traffic and public traffic were never separated.
**Steps:**
1. Reach the router on port 8888 (svc/router), e.g. via ingress-exposed deployment.
2. Guess a function's metadata.name and namespace.
3. Send `GET /fission-function/<ns>/<name>` with arbitrary headers/body.
4. Observe 200 (invoked), 404 (no such function) or 502 (cold start) to confirm and enumerate.
**How found:** Code reading of pkg/router/httpTriggers.go:280-284 showed internalRoute registration via utils.UrlForFunction bound to the function handler for every Function, independent of HTTPTrigger existence, on the public listener.
**Exploitation:** Any caller able to reach the public router invokes arbitrary functions by name regardless of HTTPTrigger host/path/method restrictions, reaching functions intended only as timer/kubewatcher/mqtrigger targets; in multi-tenant clusters this crosses namespace boundaries.
**Escalation:** Name enumeration via 404/200/502 response semantics; cross-tenant invocation when tenant A's pods reach functions in tenant B's namespace.
**Insight:** When a serverless/FaaS router auto-registers a per-object internal route, check whether that route lands on the same listener as user-facing triggers — internal trigger paths are a common authorization blind spot.