Summary
Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables
Before the round-1 security sweep, pkg/builder/builder.go passed Environment.spec.builder.command directly into exec.Command(...) after a strings.Fields split, with no validation of the executable path or its arguments. A user who could create or update Environment CRDs in a namespace observed by the buildermgr could thereby point the builder pod at any executable inside the builder image (e.g. /bin/sh -c '...') and execute arbitrary code in the builder pod context.
Affected component
pkg/builder/builder.go:254, call site (exec.Command(buildCmd, buildArgs...)).pkg/builder/builder.go:106, input source:buildCmd, buildArgs = strings.Fields(req.BuildCommand)[0], strings.Fields(req.BuildCommand)[1:].
Root cause
pkg/builder/builder.go's build-command parser did not validate the resulting executable path. Although exec.Command does not invoke a shell, it does locate the executable via $PATH, and strings.Fields splitting allowed multiple flags / sub-arguments to be passed.
Mitigation (until upgrade)
- Restrict who can create / update
EnvironmentCRDs to trusted operators only. - Audit
Environment.spec.builder.commandvalues for any non-/buildpaths. - Run the buildermgr with a tightened ServiceAccount that has no secret access in the builder namespace.
Impact
A subject with create / update privilege on Environment objects could:
- Cause the builder pod for any package using that environment to execute arbitrary code.
- Read whatever files the builder pod has access to inside its
/packagesshared volume (deployment archive payloads for that package). - Write arbitrary content into the
/packagesshared volume, which the fetcher subsequently uploads as the package deployment archive.
The builder pod runs in the user's namespace with the fission-builder SA (not the more-privileged executor SA), so the impact is bounded to that namespace's package contents and the builder pod's own filesystem. PR:H reflects that creating / modifying Environment CRDs is typically restricted to cluster admins or platform operators.
Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Released in v1.23.0:
- PR #3364 (commit
0f45c911) introducesBuilder.resolveBuildCommandinpkg/builder/builder.go, which:- Accepts an empty string (treated as the default
/build). - Accepts the literal
/build. - Accepts any absolute path that survives
filepath.Cleanand contains no..segments. - Rejects anything containing whitespace metacharacters or relative paths.
- Accepts an empty string (treated as the default
exec.Commandstill receives only the validated absolute path; sub-arguments continue to come fromstrings.Fieldsof the original string but are now passed positionally with no shell expansion.
Frequently Asked Questions
- What is CVE-2026-46618? CVE-2026-46618 is a medium-severity OS command injection vulnerability in github.com/fission/fission (go), affecting versions <= 1.22.0. It is fixed in 1.23.0. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
- Which versions of github.com/fission/fission are affected by CVE-2026-46618? github.com/fission/fission (go) versions <= 1.22.0 is affected.
- Is there a fix for CVE-2026-46618? Yes. CVE-2026-46618 is fixed in 1.23.0. Upgrade to this version or later.
- Is CVE-2026-46618 exploitable, and should I be worried? Whether CVE-2026-46618 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-46618 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-46618? Upgrade
github.com/fission/fissionto 1.23.0 or later.