CWE-441
Allowed-with-ReviewUnintended Proxy or Intermediary ('Confused Deputy')
Abstraction: Class · Status: Draft
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
153 vulnerabilities reference this CWE, most recent first.
GHSA-RF7H-9M85-535V
Vulnerability from github – Published: 2022-05-14 02:21 – Updated: 2022-12-12 16:29A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. As of version 0.11, this form validation method requires POST requests and Overall/Administer permissions.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.10"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:publish-over-cifs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-1999038"
],
"database_specific": {
"cwe_ids": [
"CWE-441"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-12T16:29:27Z",
"nvd_published_at": "2018-08-01T13:29:00Z",
"severity": "MODERATE"
},
"details": "A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. As of version 0.11, this form validation method requires POST requests and Overall/Administer permissions.",
"id": "GHSA-rf7h-9m85-535v",
"modified": "2022-12-12T16:29:27Z",
"published": "2022-05-14T02:21:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1999038"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/publish-over-cifs-plugin/commit/9402d8c1044508c2fc30a5dd1e34afe6819616a0"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/publish-over-cifs-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2018-07-30/#SECURITY-975"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Publisher Over CIFS Plugin confused deputy vulnerability"
}
GHSA-RQ43-VGRV-48M9
Vulnerability from github – Published: 2022-05-14 01:11 – Updated: 2022-05-14 01:11Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.
{
"affected": [],
"aliases": [
"CVE-2018-12182"
],
"database_specific": {
"cwe_ids": [
"CWE-441"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-27T20:29:00Z",
"severity": "MODERATE"
},
"details": "Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.",
"id": "GHSA-rq43-vgrv-48m9",
"modified": "2022-05-14T01:11:02Z",
"published": "2022-05-14T01:11:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12182"
},
{
"type": "WEB",
"url": "https://edk2-docs.gitbooks.io/security-advisory/content/sw-smi-confused-deputy-smramsavestate_c.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TQYVZRFEXSN3KS43AVH4D7QX553EZQYP"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03912en_us"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107648"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RV4R-G5X6-M95W
Vulnerability from github – Published: 2025-12-11 21:31 – Updated: 2025-12-11 21:31In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2025-36889"
],
"database_specific": {
"cwe_ids": [
"CWE-441"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-11T20:15:55Z",
"severity": "MODERATE"
},
"details": "In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-rv4r-g5x6-m95w",
"modified": "2025-12-11T21:31:33Z",
"published": "2025-12-11T21:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36889"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2025-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RW75-27G5-4C67
Vulnerability from github – Published: 2026-01-03 00:31 – Updated: 2026-02-26 21:31A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was fixed on 2025-12-1 (December, 2025). End users do not have to take any action to mitigate the issue.
{
"affected": [],
"aliases": [
"CVE-2025-64123"
],
"database_specific": {
"cwe_ids": [
"CWE-441"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-02T22:15:44Z",
"severity": "CRITICAL"
},
"details": "A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was fixed on 2025-12-1 (December, 2025). End users do not have to take any action to mitigate the issue.",
"id": "GHSA-rw75-27g5-4c67",
"modified": "2026-02-26T21:31:25Z",
"published": "2026-01-03T00:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64123"
},
{
"type": "WEB",
"url": "https://www.dragos.com/community/advisories/CVE-2025-64119"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RWW4-4W9C-7733
Vulnerability from github – Published: 2026-03-31 22:32 – Updated: 2026-04-06 17:37Summary
While testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. In combination with GitHub’s behavior of skipping the consent page for previously authorized clients, this introduces a Confused Deputy vulnerability.
Technical Details
An adversary can initiate an authentication flow by connecting their malicious MCP client to a benign MCP server using the GitHubProvider OAuth integration. During this flow, the attacker consents to connect their client to the MCP server and, at that point, can capture the GitHub authorization URL they are redirected to after granting consent. The attacker can then lure a victim, who is already logged into GitHub and has previously connected an MCP client to the benign MCP server, to open this captured URL. As a result, the victim’s browser is immediately redirected to the OAuthProxy’s callback endpoint, which does not correctly enforce that this browser has just given consent. The OAuthProxy then redirects the victim’s browser to the malicious MCP client’s callback URL with a valid authorization code. The attacker can exchange this code for an access token to the benign MCP server associated with the victim’s GitHub account, potentially gaining unauthorized access to resources tied to that account.
Although this issue was verified in practice only for the GitHubProvider, a review of the source code, specifically the OAuthProxy._handle_idp_callback function, shows that the IdP callback handler does not verify whether the browser sending the state and code has previously consented to connecting the client to the server. As long as a valid state and code pair is provided, the OAuthProxy requests an access token from the IdP and then redirects the user-agent to the client’s callback URL with a new code and the corresponding state, allowing the client to retrieve the access token from the proxy. This pattern causes all OAuth integrations whose IdP allows skipping the consent page to be vulnerable to this attack.
Skipping the consent page is not, by itself, a vulnerability on the IdP side. Many providers legitimately skip consent for first-party or previously authorized clients with the same scopes. In this case, the core problem lies in the OAuthProxy callback handler not correctly verifying that the browser issuing the callback request is the same one that has just given the required consent.
Steps to reproduce
- Set up an MCP server using the GitHubProvider integration.
- Connect a benign MCP client to this MCP server.
- Configure your default browser to route all traffic through an interception proxy such as Burp Suite.
- In a private browsing window or a second browser, log into the GitHub account used in step 2.
- As the attacker, connect a new (malicious) MCP client to the MCP server from step 1.
- When the browser opens for the attacker’s client, enable interception in your proxy.
- In the browser, confirm the consent prompt.
- In the proxy, forward all requests up to the authorization request to the GitHub authorization server.
- Copy the authorization URL and drop the intercepted request.
- Simulate luring the victim onto the URL by opening this URL in the browser window opened in step 4.
- Observe that the malicious client receives a valid authorization code and gains access to the benign MCP server using the victim’s GitHub account.
In a more realistic scenario, the malicious client could be a public MCP client or a simple web server that logs the received authorization code or token, which the attacker then uses to obtain the access token and connect to the MCP server as the victim.
Recommendation
To mitigate this issue, the OAuthProxy should verify that the browser sending the authorization code has actually given consent for the corresponding client. This can be achieved by setting and validating a consent cookie or similar browser-bound state, as described in the mitigations section for this vulnerability in the MCP specification.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "fastmcp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-27124"
],
"database_specific": {
"cwe_ids": [
"CWE-441"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-31T22:32:28Z",
"nvd_published_at": "2026-04-03T16:16:36Z",
"severity": "HIGH"
},
"details": "## Summary\nWhile testing the *GitHubProvider* OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user\u0027s consent upon receiving the authorization code from GitHub. In combination with GitHub\u2019s behavior of skipping the consent page for previously authorized clients, this introduces a Confused Deputy vulnerability.\n\n## Technical Details\nAn adversary can initiate an authentication flow by connecting their malicious MCP client to a benign MCP server using the *GitHubProvider* OAuth integration. During this flow, the attacker consents to connect their client to the MCP server and, at that point, can capture the GitHub authorization URL they are redirected to after granting consent. The attacker can then lure a victim, who is already logged into GitHub and has previously connected an MCP client to the benign MCP server, to open this captured URL. As a result, the victim\u2019s browser is immediately redirected to the OAuthProxy\u2019s callback endpoint, which does not correctly enforce that this browser has just given consent. The OAuthProxy then redirects the victim\u2019s browser to the malicious MCP client\u2019s callback URL with a valid authorization code. The attacker can exchange this code for an access token to the benign MCP server associated with the victim\u2019s GitHub account, potentially gaining unauthorized access to resources tied to that account.\n\nAlthough this issue was verified in practice only for the *GitHubProvider*, a review of the source code, specifically the `OAuthProxy._handle_idp_callback` [function](https://github.com/jlowin/fastmcp/blob/ee5f465a82350e1c5a56c4a2b47cfdc4cd736e76/src/fastmcp/server/auth/oauth_proxy.py#L1762), shows that the IdP callback handler does not verify whether the browser sending the `state` and `code` has previously consented to connecting the client to the server. As long as a valid `state` and `code` pair is provided, the OAuthProxy requests an access token from the IdP and then redirects the user-agent to the client\u2019s callback URL with a new `code` and the corresponding `state`, allowing the client to retrieve the access token from the proxy. This pattern causes all OAuth integrations whose IdP allows skipping the consent page to be vulnerable to this attack.\n\nSkipping the consent page is not, by itself, a vulnerability on the IdP side. Many providers legitimately skip consent for first-party or previously authorized clients with the same scopes. In this case, the core problem lies in the OAuthProxy callback handler not correctly verifying that the browser issuing the callback request is the same one that has just given the required consent.\n\n## Steps to reproduce\n1. Set up an MCP server using the *GitHubProvider* integration.\n2. Connect a benign MCP client to this MCP server.\n3. Configure your default browser to route all traffic through an interception proxy such as Burp Suite.\n4. In a private browsing window or a second browser, log into the GitHub account used in step 2.\n5. As the attacker, connect a new (malicious) MCP client to the MCP server from step 1.\n6. When the browser opens for the attacker\u2019s client, enable interception in your proxy.\n7. In the browser, confirm the consent prompt.\n8. In the proxy, forward all requests up to the authorization request to the GitHub authorization server.\n9. Copy the authorization URL and drop the intercepted request.\n10. Simulate luring the victim onto the URL by opening this URL in the browser window opened in step 4.\n11. Observe that the malicious client receives a valid authorization code and gains access to the benign MCP server using the victim\u2019s GitHub account.\n\nIn a more realistic scenario, the malicious client could be a public MCP client or a simple web server that logs the received authorization code or token, which the attacker then uses to obtain the access token and connect to the MCP server as the victim.\n\n## Recommendation\n\nTo mitigate this issue, the OAuthProxy should verify that the browser sending the authorization code has actually given consent for the corresponding client. This can be achieved by setting and validating a consent cookie or similar browser-bound state, as described in the [mitigations section](https://mcp.mintlify.app/specification/2025-11-25/basic/security_best_practices#mitigation) for this vulnerability in the MCP specification.",
"id": "GHSA-rww4-4w9c-7733",
"modified": "2026-04-06T17:37:56Z",
"published": "2026-03-31T22:32:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-rww4-4w9c-7733"
},
{
"type": "WEB",
"url": "https://github.com/jlowin/fastmcp/security/advisories/GHSA-rww4-4w9c-7733"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27124"
},
{
"type": "PACKAGE",
"url": "https://github.com/PrefectHQ/fastmcp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities"
}
GHSA-RXXH-J336-V3C7
Vulnerability from github – Published: 2025-09-04 21:31 – Updated: 2025-09-04 21:31In isSystemUid of AccountManagerService.java, there is a possible way for an app to access privileged APIs due to a confused deputy. This could lead to local privilege escalation with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2025-48545"
],
"database_specific": {
"cwe_ids": [
"CWE-441"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-04T19:15:41Z",
"severity": "MODERATE"
},
"details": "In isSystemUid of AccountManagerService.java, there is a possible way for an app to access privileged APIs due to a confused deputy. This could lead to local privilege escalation with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-rxxh-j336-v3c7",
"modified": "2025-09-04T21:31:38Z",
"published": "2025-09-04T21:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48545"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/66ac17909252c80b0edf7f4ae282bce4579410ad"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2025-09-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V2W2-GRHG-JF52
Vulnerability from github – Published: 2026-03-02 21:31 – Updated: 2026-03-06 06:30In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2026-0013"
],
"database_specific": {
"cwe_ids": [
"CWE-441"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-02T19:16:29Z",
"severity": "HIGH"
},
"details": "In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-v2w2-grhg-jf52",
"modified": "2026-03-06T06:30:30Z",
"published": "2026-03-02T21:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0013"
},
{
"type": "WEB",
"url": "https://source.android.com/docs/security/bulletin/2026/2026-03-01"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2026-03-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VFWV-3CV9-CXM2
Vulnerability from github – Published: 2025-04-04 03:30 – Updated: 2025-04-04 03:30Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated attacker to use the product as an intermediary for FTP bounce attack.
{
"affected": [],
"aliases": [
"CVE-2025-25061"
],
"database_specific": {
"cwe_ids": [
"CWE-441"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-04T02:15:17Z",
"severity": "MODERATE"
},
"details": "Unintended proxy or intermediary (\u0027Confused Deputy\u0027) issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated attacker to use the product as an intermediary for FTP bounce attack.",
"id": "GHSA-vfwv-3cv9-cxm2",
"modified": "2025-04-04T03:30:20Z",
"published": "2025-04-04T03:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25061"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN17260367"
},
{
"type": "WEB",
"url": "https://www.electronics.jtekt.co.jp/en/topics/202503207269"
},
{
"type": "WEB",
"url": "https://www.electronics.jtekt.co.jp/en/topics/202503207271"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VJHC-CF4P-72Q4
Vulnerability from github – Published: 2026-06-30 18:15 – Updated: 2026-06-30 18:15Summary
Fission's buildermgr controller processed Package CRDs without verifying that Package.spec.environment.namespace matched Package.metadata.namespace.
Details
An attacker with packages.fission.io/create in their own namespace could set spec.environment.namespace to any other tenant's namespace. The controller then used its high-privilege service account to fetch the Environment
cross-namespace and dispatch the build command into the victim namespace's builder pod.
The build command's stdout is written verbatim into Package.status.buildlog. By running malicious code through an npm preinstall lifecycle hook (or any equivalent build step), the attacker could read the victim namespace's
fission-builder Bearer token from inside that builder pod and surface it through the build log — then use the leaked token to read every Secret and ConfigMap in the victim namespace.
Impact
Cross-tenant compromise: a package author in one namespace could execute code inside another tenant's builder pod and exfiltrate that namespace's fission-builder service-account token, giving namespace-wide secret and configmap read in
the victim namespace.
Fix
Fixed in #3379 and released in v1.24.0. Two checks in series:
- Admission webhook (
pkg/webhook/package.go::Validate) rejectsPackage.spec.environment.namespace != Package.metadata.namespace. An empty namespace is still accepted; the controllers default it to the package's own namespace. - Controller belt-and-braces: the same check is repeated in
pkg/buildermgr/pkgwatcher.go::buildandpkg/buildermgr/common.go::buildPackagebefore the cross-namespaceEnvironments(...).Getcall, so a stale Package CR or a webhook-bypass cluster (failurePolicy=Ignore) cannot exploit the primitive either.
Behavioural change
Packages that explicitly set spec.environment.namespace to a different namespace are now rejected at admission. Empty-string remains accepted (resolves to the package's own namespace, the same as the prior implicit behaviour).
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.23.0"
},
"package": {
"ecosystem": "Go",
"name": "github.com/fission/fission"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.24.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-49821"
],
"database_specific": {
"cwe_ids": [
"CWE-441",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-30T18:15:27Z",
"nvd_published_at": "2026-06-10T18:17:10Z",
"severity": "HIGH"
},
"details": "### Summary\n\nFission\u0027s `buildermgr` controller processed `Package` CRDs without verifying that `Package.spec.environment.namespace` matched `Package.metadata.namespace`.\n\n### Details\n\nAn attacker with `packages.fission.io/create` in their own namespace could set `spec.environment.namespace` to any other tenant\u0027s namespace. The controller then used its high-privilege service account to fetch the Environment\ncross-namespace and dispatch the build command into the **victim namespace\u0027s** builder pod.\n\nThe build command\u0027s stdout is written verbatim into `Package.status.buildlog`. By running malicious code through an npm `preinstall` lifecycle hook (or any equivalent build step), the attacker could read the victim namespace\u0027s\n`fission-builder` Bearer token from inside that builder pod and surface it through the build log \u2014 then use the leaked token to read every Secret and ConfigMap in the victim namespace.\n\n### Impact\n\nCross-tenant compromise: a package author in one namespace could execute code inside another tenant\u0027s builder pod and exfiltrate that namespace\u0027s `fission-builder` service-account token, giving namespace-wide secret and configmap read in\n the victim namespace.\n\n### Fix\n\nFixed in [#3379](https://github.com/fission/fission/pull/3379) and released in [v1.24.0](https://github.com/fission/fission/releases/tag/v1.24.0). Two checks in series:\n\n- **Admission webhook** (`pkg/webhook/package.go::Validate`) rejects `Package.spec.environment.namespace != Package.metadata.namespace`. An empty namespace is still accepted; the controllers default it to the package\u0027s own namespace.\n- **Controller belt-and-braces:** the same check is repeated in `pkg/buildermgr/pkgwatcher.go::build` and `pkg/buildermgr/common.go::buildPackage` before the cross-namespace `Environments(...).Get` call, so a stale Package CR or a\nwebhook-bypass cluster (`failurePolicy=Ignore`) cannot exploit the primitive either.\n\n### Behavioural change\n\nPackages that explicitly set `spec.environment.namespace` to a different namespace are now rejected at admission. Empty-string remains accepted (resolves to the package\u0027s own namespace, the same as the prior implicit behaviour).",
"id": "GHSA-vjhc-cf4p-72q4",
"modified": "2026-06-30T18:15:27Z",
"published": "2026-06-30T18:15:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/fission/fission/security/advisories/GHSA-vjhc-cf4p-72q4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49821"
},
{
"type": "WEB",
"url": "https://github.com/fission/fission/pull/3379"
},
{
"type": "WEB",
"url": "https://github.com/fission/fission/commit/e2b92663499f4dc3a1e2d38178f39c3c65e0134a"
},
{
"type": "PACKAGE",
"url": "https://github.com/fission/fission"
},
{
"type": "WEB",
"url": "https://github.com/fission/fission/releases/tag/v1.24.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration"
}
GHSA-VW47-MR44-3JF9
Vulnerability from github – Published: 2021-09-21 18:28 – Updated: 2026-06-09 10:51A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.22.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-25740"
],
"database_specific": {
"cwe_ids": [
"CWE-441",
"CWE-610"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-21T14:54:49Z",
"nvd_published_at": "2021-09-20T17:15:00Z",
"severity": "LOW"
},
"details": "A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.",
"id": "GHSA-vw47-mr44-3jf9",
"modified": "2026-06-09T10:51:38Z",
"published": "2021-09-21T18:28:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25740"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/103675"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubernetes/kubernetes"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/kubernetes-security-announce/c/WYE9ptrhSLE"
},
{
"type": "WEB",
"url": "https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20211014-0001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Confused Deputy in Kubernetes"
}
Mitigation
Enforce the use of strong mutual authentication mechanism between the two parties.
Mitigation
Whenever a product is an intermediary or proxy for transactions between two other components, the proxy core should not drop the identity of the initiator of the transaction. The immutability of the identity of the initiator must be maintained and should be forwarded all the way to the target.
CAPEC-219: XML Routing Detour Attacks
An attacker subverts an intermediate system used to process XML content and forces the intermediate to modify and/or re-route the processing of the content. XML Routing Detour Attacks are Adversary in the Middle type attacks (CAPEC-94). The attacker compromises or inserts an intermediate system in the processing of the XML message. For example, WS-Routing can be used to specify a series of nodes or intermediaries through which content is passed. If any of the intermediate nodes in this route are compromised by an attacker they could be used for a routing detour attack. From the compromised system the attacker is able to route the XML process to other nodes of their choice and modify the responses so that the normal chain of processing is unaware of the interception. This system can forward the message to an outside entity and hide the forwarding and processing from the legitimate processing systems by altering the header information.
CAPEC-465: Transparent Proxy Abuse
A transparent proxy serves as an intermediate between the client and the internet at large. It intercepts all requests originating from the client and forwards them to the correct location. The proxy also intercepts all responses to the client and forwards these to the client. All of this is done in a manner transparent to the client.