CVE-2026-50545 IBM QRadar · QRadar

Detect CVE-2026-50545 — Fission Environment CRD PodSpec Injection Leading to Node Escape in IBM QRadar

Detects exploitation of CVE-2026-50545, a critical privilege escalation vulnerability in Fission serverless framework (<=1.23.0) where an attacker with permissions to create or modify Fission Environment CRDs can inject arbitrary PodSpec fields. This enables mounting host paths, disabling securityContext constraints, running privileged containers, or escaping to the underlying Kubernetes node, potentially resulting in full cluster takeover. CVSS 9.9.

MITRE ATT&CK

Tactic
Privilege Escalation Lateral Movement Impact

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  username AS actor,
  sourceip,
  "URL" AS api_path,
  QIDNAME(qid) AS event_name,
  payload
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) ILIKE '%kubernetes%'
  AND LOWER(payload) LIKE '%fission.io%'
  AND LOWER(payload) LIKE '%environments%'
  AND (
    LOWER("URL") LIKE '%environments%'
    OR LOWER(payload) LIKE '%podspec%'
  )
  AND (
    LOWER(payload) LIKE '%hostpid%:true%'
    OR LOWER(payload) LIKE '%hostnetwork%:true%'
    OR LOWER(payload) LIKE '%hostipc%:true%'
    OR LOWER(payload) LIKE '%privileged%:true%'
    OR LOWER(payload) LIKE '%hostpath%'
  )
  AND INOFFENSE(this)
LAST 7 DAYS
critical severity medium confidence

QRadar AQL query searching Kubernetes audit log events for Fission Environment CRD writes containing PodSpec injection indicators consistent with CVE-2026-50545 exploitation.

Data Sources

Kubernetes Audit LogsQRadar Kubernetes DSM

Required Tables

events

False Positives & Tuning

  • Routine Fission framework administration tasks performed by privileged cluster operators
  • Infrastructure automation tools applying approved Fission Environment templates with host-level configuration
  • Disaster recovery operations restoring Fission CRD state from backup manifests

Other platforms for CVE-2026-50545

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Fission Environment CRD HostPID Injection

    Expected signal: Kubernetes audit log entry: verb=create, objectRef.resource=environments, objectRef.namespace=fission, requestObject containing spec.runtime.podspec.hostPID=true and securityContext.privileged=true

  2. Test 2Fission Environment HostPath Volume Mount for Node Escape

    Expected signal: Kubernetes audit log showing spec.runtime.podspec.volumes[].hostPath.path='/' in the Fission Environment requestObject

  3. Test 3Fission Function Execution with Injected Privileged Container

    Expected signal: Kubernetes audit events for Environment create (with hostIPC/privileged), Function create referencing it, and pod create in fission-function namespace with SecurityContext.privileged=true; CrowdStrike ProcessRollup2 events from the Fission executor with privileged container indicators

Last updated: 2026-07-03 Research depth: standard
References (8)

Unlock Pro Content

Get the full detection package for CVE-2026-50545 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0008Lateral MovementTA0040Impact

Related Techniques

T1611Escape to HostT1610Deploy ContainerT1078Valid AccountsT1552.007Container API

Same Tactic: Privilege Escalation

Popular Detections