Detect CVE-2026-50545 — Fission Environment CRD PodSpec Injection Leading to Node Escape in Microsoft Sentinel
Detects exploitation of CVE-2026-50545, a critical privilege escalation vulnerability in Fission serverless framework (<=1.23.0) where an attacker with permissions to create or modify Fission Environment CRDs can inject arbitrary PodSpec fields. This enables mounting host paths, disabling securityContext constraints, running privileged containers, or escaping to the underlying Kubernetes node, potentially resulting in full cluster takeover. CVSS 9.9.
MITRE ATT&CK
KQL Detection Query
union
AuditLogs,
AzureDiagnostics
| where Category == "kube-audit"
| extend log = parse_json(log_s)
| where log.verb in ("create", "update", "patch")
and log.objectRef.resource == "environments"
and log.objectRef.apiGroup has "fission.io"
| extend requestObject = parse_json(tostring(log.requestObject))
| extend podSpec = requestObject.spec.runtime.podspec
| where isnotnull(podSpec)
and (
podSpec.hostPID == true
or podSpec.hostNetwork == true
or podSpec.hostIPC == true
or isnotnull(podSpec.volumes)
or (podSpec.securityContext.privileged == true)
or isnotnull(podSpec.initContainers)
or isnotnull(podSpec.tolerations)
or isnotnull(podSpec.nodeSelector)
)
| extend actor = tostring(log.user.username)
| extend sourceIP = tostring(log.sourceIPs[0])
| extend targetNamespace = tostring(log.objectRef.namespace)
| extend environmentName = tostring(log.objectRef.name)
| project TimeGenerated, actor, sourceIP, targetNamespace, environmentName, podSpec, log.verbDetects creation or modification of Fission Environment CRDs containing suspicious PodSpec fields such as hostPID, hostNetwork, hostIPC, privileged containers, or host volume mounts — indicators of CVE-2026-50545 exploitation via Kubernetes audit logs.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Fission administrators deploying environments with custom podSpec fields for performance reasons
- Infrastructure-as-code pipelines applying templated Fission environment manifests with host networking for specific use cases
- Security tooling or admission webhooks performing test mutations against Fission CRDs in staging clusters
Other platforms for CVE-2026-50545
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Fission Environment CRD HostPID Injection
Expected signal: Kubernetes audit log entry: verb=create, objectRef.resource=environments, objectRef.namespace=fission, requestObject containing spec.runtime.podspec.hostPID=true and securityContext.privileged=true
- Test 2Fission Environment HostPath Volume Mount for Node Escape
Expected signal: Kubernetes audit log showing spec.runtime.podspec.volumes[].hostPath.path='/' in the Fission Environment requestObject
- Test 3Fission Function Execution with Injected Privileged Container
Expected signal: Kubernetes audit events for Environment create (with hostIPC/privileged), Function create referencing it, and pod create in fission-function namespace with SecurityContext.privileged=true; CrowdStrike ProcessRollup2 events from the Fission executor with privileged container indicators
References (8)
- https://github.com/fission/fission/security/advisories/GHSA-wmgg-3p4h-48x7
- https://nvd.nist.gov/vuln/detail/CVE-2026-50545
- https://github.com/fission/fission/pull/3390
- https://github.com/fission/fission/pull/3391
- https://github.com/fission/fission/commit/8fa799417c77ce8a0189d9858bfe11ece29b84a6
- https://github.com/fission/fission/commit/e484df8460bb4e8026e24210120602aa7f181f64
- https://github.com/fission/fission/releases/tag/v1.24.0
- https://github.com/advisories/GHSA-wmgg-3p4h-48x7
Unlock Pro Content
Get the full detection package for CVE-2026-50545 including response playbook, investigation guide, and atomic red team tests.