CVE-2026-50545 — Fission Environment CRD PodSpec Injection Leading to Node Escape

union
    AuditLogs,
    AzureDiagnostics
| where Category == "kube-audit"
| extend log = parse_json(log_s)
| where log.verb in ("create", "update", "patch")
  and log.objectRef.resource == "environments"
  and log.objectRef.apiGroup has "fission.io"
| extend requestObject = parse_json(tostring(log.requestObject))
| extend podSpec = requestObject.spec.runtime.podspec
| where isnotnull(podSpec)
  and (
    podSpec.hostPID == true
    or podSpec.hostNetwork == true
    or podSpec.hostIPC == true
    or isnotnull(podSpec.volumes)
    or (podSpec.securityContext.privileged == true)
    or isnotnull(podSpec.initContainers)
    or isnotnull(podSpec.tolerations)
    or isnotnull(podSpec.nodeSelector)
  )
| extend actor = tostring(log.user.username)
| extend sourceIP = tostring(log.sourceIPs[0])
| extend targetNamespace = tostring(log.objectRef.namespace)
| extend environmentName = tostring(log.objectRef.name)
| project TimeGenerated, actor, sourceIP, targetNamespace, environmentName, podSpec, log.verb

index=kubernetes sourcetype=kube:apiserver:audit
| spath input=_raw
| search verb IN ("create","update","patch")
  objectRef.resource="environments"
  objectRef.apiGroup="fission.io"
| spath path=requestObject.spec.runtime.podspec output=podSpec
| where isnotnull(podSpec) AND podSpec!=""
| spath input=podSpec
| where hostPID="true" OR hostNetwork="true" OR hostIPC="true"
  OR isnotnull(volumes) OR 'securityContext.privileged'="true"
  OR isnotnull(initContainers) OR isnotnull(tolerations)
| eval actor=user.username, srcIP=mvindex(sourceIPs,0)
| table _time, actor, srcIP, objectRef.namespace, objectRef.name, verb, podSpec

sequence by user.name
  [any where event.dataset == "kubernetes.audit_logs"
    and kubernetes.audit.verb in ("create", "update", "patch")
    and kubernetes.audit.objectRef.resource == "environments"
    and kubernetes.audit.objectRef.apiGroup : "*fission.io*"
    and (
      kubernetes.audit.requestObject.spec.runtime.podspec.hostPID == true
      or kubernetes.audit.requestObject.spec.runtime.podspec.hostNetwork == true
      or kubernetes.audit.requestObject.spec.runtime.podspec.hostIPC == true
      or kubernetes.audit.requestObject.spec.runtime.podspec.securityContext.privileged == true
      or kubernetes.audit.requestObject.spec.runtime.podspec.volumes != null
    )
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  username AS actor,
  sourceip,
  "URL" AS api_path,
  QIDNAME(qid) AS event_name,
  payload
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) ILIKE '%kubernetes%'
  AND LOWER(payload) LIKE '%fission.io%'
  AND LOWER(payload) LIKE '%environments%'
  AND (
    LOWER("URL") LIKE '%environments%'
    OR LOWER(payload) LIKE '%podspec%'
  )
  AND (
    LOWER(payload) LIKE '%hostpid%:true%'
    OR LOWER(payload) LIKE '%hostnetwork%:true%'
    OR LOWER(payload) LIKE '%hostipc%:true%'
    OR LOWER(payload) LIKE '%privileged%:true%'
    OR LOWER(payload) LIKE '%hostpath%'
  )
  AND INOFFENSE(this)
LAST 7 DAYS

_sourceCategory=kubernetes/audit
| json field=_raw "verb" as verb
| json field=_raw "objectRef.resource" as resource
| json field=_raw "objectRef.apiGroup" as apiGroup
| json field=_raw "user.username" as actor
| json field=_raw "sourceIPs[0]" as sourceIP
| json field=_raw "objectRef.namespace" as namespace
| json field=_raw "objectRef.name" as envName
| json field=_raw "requestObject.spec.runtime.podspec" as podSpec nodrop
| where verb in ("create","update","patch")
  and resource = "environments"
  and apiGroup contains "fission.io"
  and !isNull(podSpec)
  and (
    podSpec contains "hostPID\":true"
    or podSpec contains "hostNetwork\":true"
    or podSpec contains "hostIPC\":true"
    or podSpec contains "privileged\":true"
    or podSpec contains "hostPath"
  )
| fields _messagetime, actor, sourceIP, namespace, envName, verb, podSpec

rule cve_2026_50545_fission_podspec_injection {
  meta:
    author = "df00tech"
    description = "Detects Fission Environment CRD PodSpec injection (CVE-2026-50545)"
    severity = "CRITICAL"
    priority = "HIGH"

  events:
    $e.metadata.product_name = "Kubernetes"
    $e.metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
    $e.target.resource.type = "KUBERNETES_RESOURCE"
    $e.target.resource.name = /environments/
    $e.network.http.request_body = /fission\.io/
    (
      $e.network.http.request_body = /hostPID.*true/
      or $e.network.http.request_body = /hostNetwork.*true/
      or $e.network.http.request_body = /hostIPC.*true/
      or $e.network.http.request_body = /privileged.*true/
      or $e.network.http.request_body = /hostPath/
    )
    $e.principal.user.userid != ""

  match:
    $e.principal.user.userid over 5m

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| event_platform=Lin
| ImageFileName=/fission|executor|fetcher/i
| CommandLine=/(hostPID|hostNetwork|hostIPC|privileged.*true|hostPath)/i
| groupby([aid, ComputerName, UserName, ImageFileName, CommandLine])
| join
  (
    #event_simpleName=NetworkConnectIP4
    | event_platform=Lin
    | RemotePort in [443, 6443, 8443, 8080, 10250]
    | groupby([aid, ComputerName, RemoteIP, RemotePort])
  )
  on aid
| table([_time, ComputerName, UserName, ImageFileName, CommandLine, RemoteIP, RemotePort])