Fission Environment CRD PodSpec Passthrough Node Escape (CVE-2026-50564)

// Requires AKS/Azure Kubernetes audit logs forwarded to Sentinel (AzureDiagnostics / KubeAuditLogs)
let susPodSpecKeys = dynamic(["hostPID", "hostNetwork", "hostIPC", "privileged"]);
AzureDiagnostics
| where Category == "kube-audit"
| where log_s has "fission.io/environment" or log_s has "environments.fission.io"
| where log_s has_any (susPodSpecKeys)
| extend Verb = extract("\"verb\":\"([a-z]+)\"", 1, log_s)
| where Verb in ("create", "update", "patch")
| extend RequestUser = extract("\"username\":\"([^\"]+)\"", 1, log_s)
| extend Namespace = extract("\"namespace\":\"([^\"]+)\"", 1, log_s)
| project TimeGenerated, RequestUser, Namespace, Verb, log_s
| order by TimeGenerated desc

index=kubernetes sourcetype=kube:audit
("fission.io/environment" OR "environments.fission.io")
("hostPID" OR "hostNetwork" OR "hostIPC" OR "privileged\":true")
verb IN ("create","update","patch")
| eval requestUser=coalesce(user.username, requestUser)
| table _time, requestUser, objectRef.namespace, objectRef.name, verb, requestObject
| sort -_time

any where event.dataset == "kubernetes.audit" and
  kubernetes.audit.objectRef.resource == "environments" and
  kubernetes.audit.verb in ("create", "update", "patch") and
  (stringContains(kubernetes.audit.requestObject, "hostPID") or
   stringContains(kubernetes.audit.requestObject, "hostNetwork") or
   stringContains(kubernetes.audit.requestObject, "hostIPC") or
   stringContains(kubernetes.audit.requestObject, "privileged\":true"))

SELECT DATEFORMAT(devicetime,'YYYY-MM-dd HH:mm:ss') AS EventTime, username, "Namespace", "Object Name", payload
FROM events
WHERE LOGSOURCETYPENAME(logsourcetypeid) = 'Kubernetes Audit'
AND (payload ILIKE '%fission.io/environment%' OR payload ILIKE '%environments.fission.io%')
AND (payload ILIKE '%hostPID%' OR payload ILIKE '%hostNetwork%' OR payload ILIKE '%hostIPC%' OR payload ILIKE '%"privileged":true%')
AND (payload ILIKE '%"verb":"create"%' OR payload ILIKE '%"verb":"update"%' OR payload ILIKE '%"verb":"patch"%')
LAST 24 HOURS

_sourceCategory=kubernetes/audit
("fission.io/environment" OR "environments.fission.io")
and ("hostPID" or "hostNetwork" or "hostIPC" or "privileged\":true")
| json field=_raw "verb" as verb
| json field=_raw "user.username" as requestUser
| json field=_raw "objectRef.namespace" as namespace
| where verb in ("create", "update", "patch")
| fields _messagetime, requestUser, namespace, verb, _raw
| sort by _messagetime asc

rule fission_environment_privileged_podspec_passthrough {
  meta:
    author = "df00tech"
    description = "Detects CVE-2026-50564 exploitation via privileged podspec passthrough on Fission Environment CRDs"
    severity = "CRITICAL"
    cve = "CVE-2026-50564"
  events:
    $audit.metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
    $audit.target.resource.resource_subtype = "environments.fission.io"
    $audit.security_result.action = "ALLOW"
    (
      $audit.target.resource.attribute.labels.raw_data = /hostPID/ or
      $audit.target.resource.attribute.labels.raw_data = /hostNetwork/ or
      $audit.target.resource.attribute.labels.raw_data = /hostIPC/ or
      $audit.target.resource.attribute.labels.raw_data = /\"privileged\":true/
    )
  condition:
    $audit
}

#event_simpleName=K8sAuditEvent
| ObjectAPIGroup="fission.io" ObjectKind="Environment"
| Verb=create OR Verb=update OR Verb=patch
| RequestObject=*hostPID* OR RequestObject=*hostNetwork* OR RequestObject=*hostIPC* OR RequestObject="*privileged\":true*"
| table([@timestamp, UserName, ObjectNamespace, ObjectName, Verb, RequestObject])
| sort(@timestamp, order=desc)