CVE-2026-50563 Microsoft Sentinel · KQL

Detect Fission Container Executor PodSpec Injection - Node Escape Attempt in Microsoft Sentinel

Detects exploitation of CVE-2026-50563, a critical privilege escalation vulnerability in Fission serverless framework (<=1.23.0). The container executor allows unauthenticated or low-privileged users to inject arbitrary PodSpec fields into function pods, enabling container escape to the underlying Kubernetes node. Attackers can inject hostPID, hostNetwork, privileged containers, hostPath volume mounts, or custom service accounts to achieve full node compromise.

MITRE ATT&CK

Tactic
Privilege Escalation Lateral Movement Initial Access

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let SuspiciousPodSpecFields = dynamic(["hostPID", "hostNetwork", "hostIPC", "privileged", "hostPath", "allowPrivilegeEscalation"]);
let FissionNamespaces = dynamic(["fission", "fission-function", "fission-builder"]);
union
(
  AzureDiagnostics
  | where Category == "kube-audit"
  | where TimeGenerated > ago(24h)
  | extend AuditLog = parse_json(log_s)
  | where AuditLog.objectRef.resource == "pods"
  | where AuditLog.objectRef.namespace in (FissionNamespaces)
  | where AuditLog.verb in ("create", "patch", "update")
  | extend PodSpec = tostring(AuditLog.requestObject.spec)
  | where PodSpec has_any (SuspiciousPodSpecFields)
  | extend UserAgent = tostring(AuditLog.userAgent)
  | extend Username = tostring(AuditLog.user.username)
  | extend SourceIP = tostring(AuditLog.sourceIPs[0])
  | extend PodName = tostring(AuditLog.objectRef.name)
  | extend Namespace = tostring(AuditLog.objectRef.namespace)
  | project TimeGenerated, Username, SourceIP, PodName, Namespace, UserAgent, PodSpec
  | extend AlertReason = "Suspicious PodSpec field in Fission namespace pod creation"
),
(
  KubePodInventory
  | where TimeGenerated > ago(24h)
  | where Namespace in (FissionNamespaces)
  | extend PodLabels = parse_json(PodLabel)
  | extend PodAnnotations = tostring(parse_json("[]"))
  | join kind=inner (
      ContainerLog
      | where TimeGenerated > ago(24h)
      | where LogEntry has_any ("hostPID", "hostNetwork", "privileged: true", "escape", "nsenter", "/proc/1/root")
    ) on ContainerID
  | project TimeGenerated, PodName, Namespace, ContainerName, LogEntry
  | extend AlertReason = "Fission function container log indicates escape attempt"
)
| extend CVE = "CVE-2026-50563"
| extend Severity = "Critical"
critical severity high confidence

Detects PodSpec injection attempts in Fission namespaces via Kubernetes audit logs and container log indicators of node escape activity. Monitors for privileged fields being injected into function pods.

Data Sources

AzureDiagnosticsKubePodInventoryContainerLog

Required Tables

AzureDiagnosticsKubePodInventoryContainerLog

False Positives & Tuning

  • Legitimate infrastructure automation that creates privileged pods in Fission namespaces for debugging purposes
  • Kubernetes operators or admission controllers that modify pod specs during normal reconciliation
  • Security scanning tools that inspect container configurations and trigger log keywords

Other platforms for CVE-2026-50563

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Fission PodSpec Injection - hostPID Escape

    Expected signal: Kubernetes audit log entry with verb=create, objectRef.resource=pods, objectRef.namespace=fission-function, requestObject.spec.hostPID=true. Container process list will show host-level PIDs including kubelet, containerd, and other node processes.

  2. Test 2Fission PodSpec Injection - Privileged Container with hostPath Root Mount

    Expected signal: Kubernetes audit log with requestObject.spec.containers[0].securityContext.privileged=true and requestObject.spec.volumes containing hostPath.path=/. Container runtime logs showing privileged container start. Node-level filesystem access to /etc/passwd and hostname file.

  3. Test 3Fission Container Escape via nsenter After PodSpec Injection

    Expected signal: Process telemetry on Kubernetes node showing nsenter executed with --target 1 argument. Host PID 1 (init/systemd) namespace join event visible in node audit logs. Container log output matching host OS details rather than Alpine container OS.

Last updated: 2026-07-03 Research depth: standard
References (6)

Unlock Pro Content

Get the full detection package for CVE-2026-50563 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0008Lateral MovementTA0001Initial Access

Related Techniques

T1611Escape to HostT1078Valid AccountsT1610Deploy Container

Same Tactic: Privilege Escalation

Popular Detections