# Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration

Fission buildermgr trusted Package.spec.environment.namespace, letting a tenant dispatch builds into another namespace's builder pod and leak its SA token via buildlog.

- Payout: Research
- Severity: high
- Program: Fission
- Found by: j311yl0v3u, b0b0haha
- Disclosed: 2026-06-30
- CVE: CVE-2026-49821
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-vjhc-cf4p-72q4
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-vjhc-cf4p-72q4
- Tags: area:cloud domain:cloud domain:infra impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:kubernetes technique:source-review vuln:access-control vuln:secrets-leak

**Target:** Kubernetes buildermgr controller and Package CRD admission webhook
**Root cause:** buildermgr fetched Package.spec.environment.namespace cross-namespace with its high-privilege SA without checking it matched Package.metadata.namespace, acting as a confused deputy.
**Steps:**
1. Create a Package CR in attacker namespace with `spec.environment.namespace` set to the victim namespace.
2. Controller uses its SA to fetch the victim Environment and dispatches the build into the victim namespace's builder pod.
3. Supply a malicious npm `preinstall` lifecycle hook (or equivalent build step) that reads the `fission-builder` Bearer token inside the pod.
4. Token is echoed to stdout, written verbatim into `Package.status.buildlog`.
5. Use leaked token to read all Secrets and ConfigMaps in the victim namespace.
**Exploitation:** Attacker with packages.fission.io/create in their own namespace sets environment.namespace to a victim tenant; buildermgr's privileged SA resolves the cross-namespace Environment and runs the attacker's build command in the victim's builder pod, exfiltrating the builder SA token through the build log.
**Escalation:** Leaked fission-builder token grants namespace-wide read of Secrets and ConfigMaps in the victim namespace.
**Insight:** On multi-tenant controllers, audit every CRD field that names a namespace: if the controller resolves it with its own SA rather than the requester's, it's a confused-deputy primitive — and build logs are a ready exfil channel.