Detections
Analytics
SCA: security update for github.com/fission/fission (GHSA-3g33-6vg6-27m8)
critical Tenable Self-Hosted Container Security Plugin ID 442288
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of
functions and applications on Kubernetes. Prior to version 1.23.0, the Fission router registers an
internal-style route — /fission-function/<name> and /fission-function/<ns>/<name> — for every Function
object, independent of whether any HTTPTrigger exists for that function. The route was mounted on the same
listener as user-defined HTTPTriggers (svc/router, port 8888), so any caller who could reach the router
could invoke any function by guessing its metadata.name (and namespace), bypassing the host / path /
method / method-allow-list restrictions encoded in HTTPTrigger objects. This issue has been patched in
version 1.23.0. (CVE-2026-46614)
Solution
Update the github.com/fission/fission library and its related packages to version 1.23.0 or later.See Also
Plugin Details
Severity: Critical
ID: 442288
Version: Revision 1.8
Type: Local
Family: SCA Checks
Published: 5/22/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.87
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-46614
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/21/2026
Vulnerability Publication Date: 5/21/2026
Reference Information
CVE: CVE-2026-46614