CVE-2026-50565: Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container
Fission builder pods were created with ServiceAccountName: fission-builder and no AutomountServiceAccountToken: false, so the kubelet auto-mounted the service-account token into every container in the pod — including the
user-supplied builder image.
References
- github.com/advisories/GHSA-8wcj-mfrc-jx5q
- github.com/fission/fission/commit/8fa799417c77ce8a0189d9858bfe11ece29b84a6
- github.com/fission/fission/pull/3390
- github.com/fission/fission/releases/tag/v1.24.0
- github.com/fission/fission/security/advisories/GHSA-8wcj-mfrc-jx5q
- nvd.nist.gov/vuln/detail/CVE-2026-50565
Code Behaviors & Features
Detect and mitigate CVE-2026-50565 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →