CVE-2026-50545 CrowdStrike LogScale · LogScale

Detect CVE-2026-50545 — Fission Environment CRD PodSpec Injection Leading to Node Escape in CrowdStrike LogScale

Detects exploitation of CVE-2026-50545, a critical privilege escalation vulnerability in Fission serverless framework (<=1.23.0) where an attacker with permissions to create or modify Fission Environment CRDs can inject arbitrary PodSpec fields. This enables mounting host paths, disabling securityContext constraints, running privileged containers, or escaping to the underlying Kubernetes node, potentially resulting in full cluster takeover. CVSS 9.9.

MITRE ATT&CK

Tactic
Privilege Escalation Lateral Movement Impact

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=ProcessRollup2
| event_platform=Lin
| ImageFileName=/fission|executor|fetcher/i
| CommandLine=/(hostPID|hostNetwork|hostIPC|privileged.*true|hostPath)/i
| groupby([aid, ComputerName, UserName, ImageFileName, CommandLine])
| join
  (
    #event_simpleName=NetworkConnectIP4
    | event_platform=Lin
    | RemotePort in [443, 6443, 8443, 8080, 10250]
    | groupby([aid, ComputerName, RemoteIP, RemotePort])
  )
  on aid
| table([_time, ComputerName, UserName, ImageFileName, CommandLine, RemoteIP, RemotePort])
critical severity medium confidence

CrowdStrike Falcon Query Language detection correlating Fission executor or fetcher process events with suspicious PodSpec-related command arguments and outbound connections to Kubernetes API or kubelet ports, indicating potential CVE-2026-50545 post-exploitation activity.

Data Sources

CrowdStrike FalconKubernetes Node Telemetry

Required Tables

ProcessRollup2NetworkConnectIP4

False Positives & Tuning

  • Fission executor containers performing legitimate function dispatch that triggers process events matching the pattern
  • Kubernetes node-level monitoring agents scanning Fission environment configurations for compliance
  • Container runtime (containerd/runc) operations spawning Fission-related processes during normal workload scheduling

Other platforms for CVE-2026-50545

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Fission Environment CRD HostPID Injection

    Expected signal: Kubernetes audit log entry: verb=create, objectRef.resource=environments, objectRef.namespace=fission, requestObject containing spec.runtime.podspec.hostPID=true and securityContext.privileged=true

  2. Test 2Fission Environment HostPath Volume Mount for Node Escape

    Expected signal: Kubernetes audit log showing spec.runtime.podspec.volumes[].hostPath.path='/' in the Fission Environment requestObject

  3. Test 3Fission Function Execution with Injected Privileged Container

    Expected signal: Kubernetes audit events for Environment create (with hostIPC/privileged), Function create referencing it, and pod create in fission-function namespace with SecurityContext.privileged=true; CrowdStrike ProcessRollup2 events from the Fission executor with privileged container indicators

Last updated: 2026-07-03 Research depth: standard
References (8)

Unlock Pro Content

Get the full detection package for CVE-2026-50545 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0008Lateral MovementTA0040Impact

Related Techniques

T1611Escape to HostT1610Deploy ContainerT1078Valid AccountsT1552.007Container API

Same Tactic: Privilege Escalation

Popular Detections