CVE-2026-50563 Splunk · SPL

Detect Fission Container Executor PodSpec Injection - Node Escape Attempt in Splunk

Detects exploitation of CVE-2026-50563, a critical privilege escalation vulnerability in Fission serverless framework (<=1.23.0). The container executor allows unauthenticated or low-privileged users to inject arbitrary PodSpec fields into function pods, enabling container escape to the underlying Kubernetes node. Attackers can inject hostPID, hostNetwork, privileged containers, hostPath volume mounts, or custom service accounts to achieve full node compromise.

MITRE ATT&CK

Tactic
Privilege Escalation Lateral Movement Initial Access

SPL Detection Query

Splunk (SPL)
spl 
index=kubernetes sourcetype=kube:apiserver:audit OR sourcetype=kube:container:log
| eval is_fission_ns=if(match('objectRef.namespace', "^fission"), 1, 0)
| eval is_pod_create=if(match(verb, "create|patch|update") AND 'objectRef.resource'="pods", 1, 0)
| eval has_privesc_field=if(
    match('requestObject.spec', "hostPID.*true|hostNetwork.*true|hostIPC.*true|privileged.*true|hostPath|allowPrivilegeEscalation.*true"),
    1, 0
  )
| eval is_escape_log=if(
    match(log, "nsenter|/proc/1/root|/host/|chroot.*proc|escape"),
    1, 0
  )
| where (is_fission_ns=1 AND is_pod_create=1 AND has_privesc_field=1) OR (is_fission_ns=1 AND is_escape_log=1)
| eval detection_type=case(
    is_pod_create=1 AND has_privesc_field=1, "PodSpec Injection",
    is_escape_log=1, "Container Escape Indicator",
    true(), "Unknown"
  )
| eval cve="CVE-2026-50563"
| eval severity="critical"
| table _time, host, 'user.username', 'sourceIPs{0}', 'objectRef.namespace', 'objectRef.name', detection_type, 'requestObject.spec', log, cve, severity
| sort -_time
critical severity high confidence

Detects Fission PodSpec injection attempts and container escape indicators from Kubernetes API server audit logs and container logs.

Data Sources

Kubernetes API Server Audit LogsKubernetes Container Logs

Required Sourcetypes

kube:apiserver:auditkube:container:log

False Positives & Tuning

  • Authorized cluster administrators creating privileged debug pods in Fission namespaces
  • Fission internal system operations that temporarily elevate pod privileges during function environment setup
  • Security tooling (Falco, Tetragon) generating logs containing escape-related keywords during baseline profiling

Other platforms for CVE-2026-50563

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Fission PodSpec Injection - hostPID Escape

    Expected signal: Kubernetes audit log entry with verb=create, objectRef.resource=pods, objectRef.namespace=fission-function, requestObject.spec.hostPID=true. Container process list will show host-level PIDs including kubelet, containerd, and other node processes.

  2. Test 2Fission PodSpec Injection - Privileged Container with hostPath Root Mount

    Expected signal: Kubernetes audit log with requestObject.spec.containers[0].securityContext.privileged=true and requestObject.spec.volumes containing hostPath.path=/. Container runtime logs showing privileged container start. Node-level filesystem access to /etc/passwd and hostname file.

  3. Test 3Fission Container Escape via nsenter After PodSpec Injection

    Expected signal: Process telemetry on Kubernetes node showing nsenter executed with --target 1 argument. Host PID 1 (init/systemd) namespace join event visible in node audit logs. Container log output matching host OS details rather than Alpine container OS.

Last updated: 2026-07-30 Research depth: standard
References (6)

Response Playbook

Triage

  1. Immediately identify the Fission version deployed: kubectl get deployment -n fission -o jsonpath='{.items[*].spec.template.spec.containers[*].image}' and confirm if <=1.23.0 is in use.
  2. Review Kubernetes audit logs for the past 72 hours for any pod creation/patch events in fission or fission-function namespaces containing hostPID, hostNetwork, privileged:true, or hostPath volume mounts pointing to host filesystem roots.
  3. Identify the originating user or service account that submitted the suspicious pod spec and trace API server authentication records to determine if the identity is legitimate or compromised.
  4. Check all running pods in Fission namespaces for active privileged configurations: kubectl get pods -n fission -o json | jq '.items[] | {name:.metadata.name, hostPID:.spec.hostPID, hostNetwork:.spec.hostNetwork, privileged:.spec.containers[].securityContext.privileged}'

Containment

  1. If exploitation is confirmed, immediately cordon affected Kubernetes nodes to prevent new pod scheduling: kubectl cordon <node-name>, then drain non-critical workloads while preserving forensic state of the compromised pod.
  2. Revoke or rotate credentials for any service accounts associated with Fission function execution that may have been exposed to the injected pod spec, and apply NetworkPolicy to isolate fission-function namespace from lateral movement paths.

Evidence Collection

  1. Capture a full memory dump and filesystem snapshot of the suspected escape pod before termination: kubectl exec <pod> -- tar czf /tmp/evidence.tar.gz /proc/self/mem /proc/self/maps && kubectl cp <pod>:/tmp/evidence.tar.gz ./evidence.tar.gz
  2. Export complete Kubernetes audit log slice covering the window of initial pod creation through detection time, preserving requestObject fields to reconstruct the exact injected PodSpec payload for forensic analysis.

Escalation Criteria

  • !Escalate to P0/Critical Incident if any Fission function pod is confirmed running with hostPID:true or as a privileged container, as node escape is likely already achieved and the entire Kubernetes node and its hosted workloads must be treated as compromised.
  • !Escalate immediately if post-exploitation indicators are found on the node: new SSH keys added to /root/.ssh/, cron jobs written to host cron directories from within a container, or evidence of lateral movement to adjacent cluster nodes via the host network.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Kubernetes API server audit log entries with verb=create/patch, resource=pods, namespace=fission*, containing requestObject.spec with hostPID/hostNetwork/privileged/hostPath fields
  • >Container runtime logs (containerd/dockerd) on affected nodes showing creation of privileged containers with host namespace access
  • >Node-level process tree showing processes spawned from within the function container that have escaped into the host PID namespace (parent PID 1 visible from within container)

Tuning Guidance

Initial deployment should alert on all privileged PodSpec field usage in Fission namespaces. After baselining, create an allowlist of legitimate service accounts (e.g., fission-svcaccount, builder-serviceaccount) that have authorized reason to create function environments, and suppress alerts for those identities creating pods without host namespace access. Reduce false positives further by scoping hostPath alerts to sensitive mount points (/, /etc, /proc, /var/run/docker.sock, /var/lib/kubelet) rather than all hostPath usage. For organizations running Fission >=1.24.0, this rule can be deprioritized but retained as a regression check.

Hunting Queries

Hunt for all historical Fission namespace pod creation events with privileged PodSpec fields over the past 7 days to identify prior exploitation attempts that may have preceded detection rule deployment.

Hunting — KQL
kql 
AzureDiagnostics
| where Category == "kube-audit"
| where TimeGenerated > ago(7d)
| extend Log = parse_json(log_s)
| where Log.objectRef.namespace startswith "fission"
| where Log.verb in ("create", "patch", "update")
| where Log.objectRef.resource == "pods"
| extend Spec = tostring(Log.requestObject.spec)
| where Spec has_any ("hostPID", "hostNetwork", "hostIPC", "privileged", "hostPath")
| extend Username = tostring(Log.user.username)
| extend SourceIP = tostring(Log.sourceIPs[0])
| summarize AttemptCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by Username, SourceIP, tostring(Log.objectRef.namespace)
| where AttemptCount > 0
| order by AttemptCount desc
Hunting — SPL
spl 
index=kubernetes sourcetype=kube:apiserver:audit earliest=-7d
| spath "objectRef.namespace" output=namespace
| spath "objectRef.resource" output=resource
| spath "verb" output=verb
| spath "requestObject.spec" output=pod_spec
| spath "user.username" output=username
| where match(namespace, "^fission") AND resource="pods" AND verb IN ("create", "patch", "update")
| where match(pod_spec, "hostPID.*true|hostNetwork.*true|privileged.*true|hostPath|hostIPC.*true")
| stats count AS attempts, earliest(_time) AS first_seen, latest(_time) AS last_seen by username, namespace
| sort -attempts

Atomic Red Team Tests

Test 1 Fission PodSpec Injection - hostPID Escape
linux

Simulates CVE-2026-50563 by creating a Fission-namespace pod with hostPID:true to access all host processes from within the container, demonstrating node escape via PID namespace sharing.

Command

bash 
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: fission-escape-test-hostpid
  namespace: fission-function
  labels:
    app: fission-escape-test
spec:
  hostPID: true
  containers:
  - name: escape-container
    image: alpine:3.19
    command: ["sh", "-c", "ps aux | head -20 && echo 'HOST PID NAMESPACE ACCESSIBLE'"]
    securityContext:
      allowPrivilegeEscalation: false
EOF
kubectl wait --for=condition=Completed pod/fission-escape-test-hostpid -n fission-function --timeout=60s
kubectl logs fission-escape-test-hostpid -n fission-function

Cleanup

bash 
kubectl delete pod fission-escape-test-hostpid -n fission-function --ignore-not-found=true

Expected Telemetry

Kubernetes audit log entry with verb=create, objectRef.resource=pods, objectRef.namespace=fission-function, requestObject.spec.hostPID=true. Container process list will show host-level PIDs including kubelet, containerd, and other node processes.

Expected Detection

Alert triggered on KQL/SPL/EQL rules monitoring for hostPID:true in Fission namespace pod creation events.

Test 2 Fission PodSpec Injection - Privileged Container with hostPath Root Mount
linux

Simulates the most severe CVE-2026-50563 exploitation path: creating a privileged container with the host root filesystem mounted, enabling full node filesystem access and persistence.

Command

bash 
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: fission-escape-test-privileged
  namespace: fission-function
  labels:
    app: fission-escape-test
spec:
  containers:
  - name: privileged-escape
    image: alpine:3.19
    command: ["sh", "-c", "ls /host-root/etc/passwd && cat /host-root/etc/hostname && echo 'HOST FILESYSTEM ACCESSIBLE'"]
    securityContext:
      privileged: true
    volumeMounts:
    - name: host-root
      mountPath: /host-root
  volumes:
  - name: host-root
    hostPath:
      path: /
EOF
kubectl wait --for=condition=Completed pod/fission-escape-test-privileged -n fission-function --timeout=60s
kubectl logs fission-escape-test-privileged -n fission-function

Cleanup

bash 
kubectl delete pod fission-escape-test-privileged -n fission-function --ignore-not-found=true

Expected Telemetry

Kubernetes audit log with requestObject.spec.containers[0].securityContext.privileged=true and requestObject.spec.volumes containing hostPath.path=/. Container runtime logs showing privileged container start. Node-level filesystem access to /etc/passwd and hostname file.

Expected Detection

High-confidence alert triggered by combined privileged:true AND hostPath:/ indicators in Fission namespace pod spec.

Test 3 Fission Container Escape via nsenter After PodSpec Injection
linux

Simulates post-exploitation phase of CVE-2026-50563 where an attacker who has created a hostPID privileged pod uses nsenter to fully escape to the host namespace and execute commands as root on the node.

Command

bash 
# First create the privileged pod (prerequisite)
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: fission-nsenter-escape
  namespace: fission-function
spec:
  hostPID: true
  containers:
  - name: escape
    image: alpine:3.19
    command: ["sh", "-c", "apk add -q util-linux && nsenter --target 1 --mount --uts --ipc --net --pid -- hostname && nsenter --target 1 --mount --uts --ipc --net --pid -- cat /etc/os-release | head -3"]
    securityContext:
      privileged: true
EOF
kubectl wait --for=condition=Completed pod/fission-nsenter-escape -n fission-function --timeout=90s
kubectl logs fission-nsenter-escape -n fission-function

Cleanup

bash 
kubectl delete pod fission-nsenter-escape -n fission-function --ignore-not-found=true

Expected Telemetry

Process telemetry on Kubernetes node showing nsenter executed with --target 1 argument. Host PID 1 (init/systemd) namespace join event visible in node audit logs. Container log output matching host OS details rather than Alpine container OS.

Expected Detection

Multi-signal detection: PodSpec injection alert followed by nsenter process execution alert correlating to same pod name and namespace within the sequence window.

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0008Lateral MovementTA0001Initial Access

Related Techniques

T1611Escape to HostT1078Valid AccountsT1610Deploy Container

Same Tactic: Privilege Escalation

Popular Detections