CVE-2026-50563

Fission Container Executor PodSpec Injection - Node Escape Attempt

Privilege Escalation Lateral Movement Initial Access Last updated:

Detects exploitation of CVE-2026-50563, a critical privilege escalation vulnerability in Fission serverless framework (<=1.23.0). The container executor allows unauthenticated or low-privileged users to inject arbitrary PodSpec fields into function pods, enabling container escape to the underlying Kubernetes node. Attackers can inject hostPID, hostNetwork, privileged containers, hostPath volume mounts, or custom service accounts to achieve full node compromise.

Vulnerability Intelligence

Public PoC

Affected Software

Vendor
go
Product
github.com/fission/fission
Versions
<= 1.23.0

Weakness (CWE)

CWE-269CWE-284

Timeline

Disclosed
June 30, 2026

CVSS

9.9
Critical (9.0–10)
CVSS vector not yet published
Read the write-up →

What is CVE-2026-50563 Fission Container Executor PodSpec Injection - Node Escape Attempt?

Fission Container Executor PodSpec Injection - Node Escape Attempt (CVE-2026-50563) maps to the Privilege Escalation and Lateral Movement and Initial Access tactics — the adversary is trying to gain higher-level permissions in MITRE ATT&CK.

This page provides production-ready detection logic for Fission Container Executor PodSpec Injection - Node Escape Attempt, covering the data sources and telemetry it touches: AzureDiagnostics, KubePodInventory, ContainerLog. The queries below are rated critical severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Privilege Escalation Lateral Movement Initial Access
Microsoft Sentinel / Defender
kusto 
let SuspiciousPodSpecFields = dynamic(["hostPID", "hostNetwork", "hostIPC", "privileged", "hostPath", "allowPrivilegeEscalation"]);
let FissionNamespaces = dynamic(["fission", "fission-function", "fission-builder"]);
union
(
  AzureDiagnostics
  | where Category == "kube-audit"
  | where TimeGenerated > ago(24h)
  | extend AuditLog = parse_json(log_s)
  | where AuditLog.objectRef.resource == "pods"
  | where AuditLog.objectRef.namespace in (FissionNamespaces)
  | where AuditLog.verb in ("create", "patch", "update")
  | extend PodSpec = tostring(AuditLog.requestObject.spec)
  | where PodSpec has_any (SuspiciousPodSpecFields)
  | extend UserAgent = tostring(AuditLog.userAgent)
  | extend Username = tostring(AuditLog.user.username)
  | extend SourceIP = tostring(AuditLog.sourceIPs[0])
  | extend PodName = tostring(AuditLog.objectRef.name)
  | extend Namespace = tostring(AuditLog.objectRef.namespace)
  | project TimeGenerated, Username, SourceIP, PodName, Namespace, UserAgent, PodSpec
  | extend AlertReason = "Suspicious PodSpec field in Fission namespace pod creation"
),
(
  KubePodInventory
  | where TimeGenerated > ago(24h)
  | where Namespace in (FissionNamespaces)
  | extend PodLabels = parse_json(PodLabel)
  | extend PodAnnotations = tostring(parse_json("[]"))
  | join kind=inner (
      ContainerLog
      | where TimeGenerated > ago(24h)
      | where LogEntry has_any ("hostPID", "hostNetwork", "privileged: true", "escape", "nsenter", "/proc/1/root")
    ) on ContainerID
  | project TimeGenerated, PodName, Namespace, ContainerName, LogEntry
  | extend AlertReason = "Fission function container log indicates escape attempt"
)
| extend CVE = "CVE-2026-50563"
| extend Severity = "Critical"

Detects PodSpec injection attempts in Fission namespaces via Kubernetes audit logs and container log indicators of node escape activity. Monitors for privileged fields being injected into function pods.

critical severity high confidence

Data Sources

AzureDiagnostics KubePodInventory ContainerLog

Required Tables

AzureDiagnostics KubePodInventory ContainerLog

False Positives

  • Legitimate infrastructure automation that creates privileged pods in Fission namespaces for debugging purposes
  • Kubernetes operators or admission controllers that modify pod specs during normal reconciliation
  • Security scanning tools that inspect container configurations and trigger log keywords

Sigma rule & cross-platform mapping

The detection logic for Fission Container Executor PodSpec Injection - Node Escape Attempt (CVE-2026-50563) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  product: azure

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-50563 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-50563

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-07-30 Research depth: standard
References (6)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Fission PodSpec Injection - hostPID Escape

    Expected signal: Kubernetes audit log entry with verb=create, objectRef.resource=pods, objectRef.namespace=fission-function, requestObject.spec.hostPID=true. Container process list will show host-level PIDs including kubelet, containerd, and other node processes.

  2. Test 2Fission PodSpec Injection - Privileged Container with hostPath Root Mount

    Expected signal: Kubernetes audit log with requestObject.spec.containers[0].securityContext.privileged=true and requestObject.spec.volumes containing hostPath.path=/. Container runtime logs showing privileged container start. Node-level filesystem access to /etc/passwd and hostname file.

  3. Test 3Fission Container Escape via nsenter After PodSpec Injection

    Expected signal: Process telemetry on Kubernetes node showing nsenter executed with --target 1 argument. Host PID 1 (init/systemd) namespace join event visible in node audit logs. Container log output matching host OS details rather than Alpine container OS.

Response Playbook

Triage

  1. Immediately identify the Fission version deployed: kubectl get deployment -n fission -o jsonpath='{.items[*].spec.template.spec.containers[*].image}' and confirm if <=1.23.0 is in use.
  2. Review Kubernetes audit logs for the past 72 hours for any pod creation/patch events in fission or fission-function namespaces containing hostPID, hostNetwork, privileged:true, or hostPath volume mounts pointing to host filesystem roots.
  3. Identify the originating user or service account that submitted the suspicious pod spec and trace API server authentication records to determine if the identity is legitimate or compromised.
  4. Check all running pods in Fission namespaces for active privileged configurations: kubectl get pods -n fission -o json | jq '.items[] | {name:.metadata.name, hostPID:.spec.hostPID, hostNetwork:.spec.hostNetwork, privileged:.spec.containers[].securityContext.privileged}'

Containment

  1. If exploitation is confirmed, immediately cordon affected Kubernetes nodes to prevent new pod scheduling: kubectl cordon <node-name>, then drain non-critical workloads while preserving forensic state of the compromised pod.
  2. Revoke or rotate credentials for any service accounts associated with Fission function execution that may have been exposed to the injected pod spec, and apply NetworkPolicy to isolate fission-function namespace from lateral movement paths.

Evidence Collection

  1. Capture a full memory dump and filesystem snapshot of the suspected escape pod before termination: kubectl exec <pod> -- tar czf /tmp/evidence.tar.gz /proc/self/mem /proc/self/maps && kubectl cp <pod>:/tmp/evidence.tar.gz ./evidence.tar.gz
  2. Export complete Kubernetes audit log slice covering the window of initial pod creation through detection time, preserving requestObject fields to reconstruct the exact injected PodSpec payload for forensic analysis.

Escalation Criteria

  • ! Escalate to P0/Critical Incident if any Fission function pod is confirmed running with hostPID:true or as a privileged container, as node escape is likely already achieved and the entire Kubernetes node and its hosted workloads must be treated as compromised.
  • ! Escalate immediately if post-exploitation indicators are found on the node: new SSH keys added to /root/.ssh/, cron jobs written to host cron directories from within a container, or evidence of lateral movement to adjacent cluster nodes via the host network.

Investigation Guide

Forensic Artifacts

  • > Kubernetes API server audit log entries with verb=create/patch, resource=pods, namespace=fission*, containing requestObject.spec with hostPID/hostNetwork/privileged/hostPath fields
  • > Container runtime logs (containerd/dockerd) on affected nodes showing creation of privileged containers with host namespace access
  • > Node-level process tree showing processes spawned from within the function container that have escaped into the host PID namespace (parent PID 1 visible from within container)

Tuning Guidance

Initial deployment should alert on all privileged PodSpec field usage in Fission namespaces. After baselining, create an allowlist of legitimate service accounts (e.g., fission-svcaccount, builder-serviceaccount) that have authorized reason to create function environments, and suppress alerts for those identities creating pods without host namespace access. Reduce false positives further by scoping hostPath alerts to sensitive mount points (/, /etc, /proc, /var/run/docker.sock, /var/lib/kubelet) rather than all hostPath usage. For organizations running Fission >=1.24.0, this rule can be deprioritized but retained as a regression check.

Hunting Queries

Hunt for all historical Fission namespace pod creation events with privileged PodSpec fields over the past 7 days to identify prior exploitation attempts that may have preceded detection rule deployment.

Hunting — KQL
kql 
AzureDiagnostics
| where Category == "kube-audit"
| where TimeGenerated > ago(7d)
| extend Log = parse_json(log_s)
| where Log.objectRef.namespace startswith "fission"
| where Log.verb in ("create", "patch", "update")
| where Log.objectRef.resource == "pods"
| extend Spec = tostring(Log.requestObject.spec)
| where Spec has_any ("hostPID", "hostNetwork", "hostIPC", "privileged", "hostPath")
| extend Username = tostring(Log.user.username)
| extend SourceIP = tostring(Log.sourceIPs[0])
| summarize AttemptCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by Username, SourceIP, tostring(Log.objectRef.namespace)
| where AttemptCount > 0
| order by AttemptCount desc
Hunting — SPL
spl 
index=kubernetes sourcetype=kube:apiserver:audit earliest=-7d
| spath "objectRef.namespace" output=namespace
| spath "objectRef.resource" output=resource
| spath "verb" output=verb
| spath "requestObject.spec" output=pod_spec
| spath "user.username" output=username
| where match(namespace, "^fission") AND resource="pods" AND verb IN ("create", "patch", "update")
| where match(pod_spec, "hostPID.*true|hostNetwork.*true|privileged.*true|hostPath|hostIPC.*true")
| stats count AS attempts, earliest(_time) AS first_seen, latest(_time) AS last_seen by username, namespace
| sort -attempts

Atomic Red Team Tests

Test 1 Fission PodSpec Injection - hostPID Escape
linux

Simulates CVE-2026-50563 by creating a Fission-namespace pod with hostPID:true to access all host processes from within the container, demonstrating node escape via PID namespace sharing.

Command

bash 
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: fission-escape-test-hostpid
  namespace: fission-function
  labels:
    app: fission-escape-test
spec:
  hostPID: true
  containers:
  - name: escape-container
    image: alpine:3.19
    command: ["sh", "-c", "ps aux | head -20 && echo 'HOST PID NAMESPACE ACCESSIBLE'"]
    securityContext:
      allowPrivilegeEscalation: false
EOF
kubectl wait --for=condition=Completed pod/fission-escape-test-hostpid -n fission-function --timeout=60s
kubectl logs fission-escape-test-hostpid -n fission-function

Cleanup

bash 
kubectl delete pod fission-escape-test-hostpid -n fission-function --ignore-not-found=true

Expected Telemetry

Kubernetes audit log entry with verb=create, objectRef.resource=pods, objectRef.namespace=fission-function, requestObject.spec.hostPID=true. Container process list will show host-level PIDs including kubelet, containerd, and other node processes.

Expected Detection

Alert triggered on KQL/SPL/EQL rules monitoring for hostPID:true in Fission namespace pod creation events.

Test 2 Fission PodSpec Injection - Privileged Container with hostPath Root Mount
linux

Simulates the most severe CVE-2026-50563 exploitation path: creating a privileged container with the host root filesystem mounted, enabling full node filesystem access and persistence.

Command

bash 
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: fission-escape-test-privileged
  namespace: fission-function
  labels:
    app: fission-escape-test
spec:
  containers:
  - name: privileged-escape
    image: alpine:3.19
    command: ["sh", "-c", "ls /host-root/etc/passwd && cat /host-root/etc/hostname && echo 'HOST FILESYSTEM ACCESSIBLE'"]
    securityContext:
      privileged: true
    volumeMounts:
    - name: host-root
      mountPath: /host-root
  volumes:
  - name: host-root
    hostPath:
      path: /
EOF
kubectl wait --for=condition=Completed pod/fission-escape-test-privileged -n fission-function --timeout=60s
kubectl logs fission-escape-test-privileged -n fission-function

Cleanup

bash 
kubectl delete pod fission-escape-test-privileged -n fission-function --ignore-not-found=true

Expected Telemetry

Kubernetes audit log with requestObject.spec.containers[0].securityContext.privileged=true and requestObject.spec.volumes containing hostPath.path=/. Container runtime logs showing privileged container start. Node-level filesystem access to /etc/passwd and hostname file.

Expected Detection

High-confidence alert triggered by combined privileged:true AND hostPath:/ indicators in Fission namespace pod spec.

Test 3 Fission Container Escape via nsenter After PodSpec Injection
linux

Simulates post-exploitation phase of CVE-2026-50563 where an attacker who has created a hostPID privileged pod uses nsenter to fully escape to the host namespace and execute commands as root on the node.

Command

bash 
# First create the privileged pod (prerequisite)
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: fission-nsenter-escape
  namespace: fission-function
spec:
  hostPID: true
  containers:
  - name: escape
    image: alpine:3.19
    command: ["sh", "-c", "apk add -q util-linux && nsenter --target 1 --mount --uts --ipc --net --pid -- hostname && nsenter --target 1 --mount --uts --ipc --net --pid -- cat /etc/os-release | head -3"]
    securityContext:
      privileged: true
EOF
kubectl wait --for=condition=Completed pod/fission-nsenter-escape -n fission-function --timeout=90s
kubectl logs fission-nsenter-escape -n fission-function

Cleanup

bash 
kubectl delete pod fission-nsenter-escape -n fission-function --ignore-not-found=true

Expected Telemetry

Process telemetry on Kubernetes node showing nsenter executed with --target 1 argument. Host PID 1 (init/systemd) namespace join event visible in node audit logs. Container log output matching host OS details rather than Alpine container OS.

Expected Detection

Multi-signal detection: PodSpec injection alert followed by nsenter process execution alert correlating to same pod name and namespace within the sequence window.

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0008Lateral MovementTA0001Initial Access

Related Techniques

T1611Escape to HostT1078Valid AccountsT1610Deploy Container

Same Tactic: Privilege Escalation

Popular Detections