Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50564.
Upgrade to ProDetect Fission Environment CRD PodSpec Passthrough Node Escape (CVE-2026-50564) in CrowdStrike LogScale
Fission (<=1.23.0) allows the Environment Custom Resource podspec passthrough (poolspec.container / poolspec.podspec) to inject arbitrary Kubernetes PodSpec fields including hostPID, hostNetwork, hostIPC, and privileged securityContext into builder/executor pods created by the fission-builder and fission-router controllers. Any principal able to create or update Environment CRDs (which in many multi-tenant Fission deployments includes low-privileged function developers) can escalate to full node compromise by scheduling a privileged, host-namespace-sharing pod, then pivoting to the underlying kubelet, container runtime socket, or other pods on the node. CVSS 9.9.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=K8sAuditEvent
| ObjectAPIGroup="fission.io" ObjectKind="Environment"
| Verb=create OR Verb=update OR Verb=patch
| RequestObject=*hostPID* OR RequestObject=*hostNetwork* OR RequestObject=*hostIPC* OR RequestObject="*privileged\":true*"
| table([@timestamp, UserName, ObjectNamespace, ObjectName, Verb, RequestObject])
| sort(@timestamp, order=desc)CrowdStrike Falcon CQL search over Kubernetes audit telemetry (Falcon Cloud Security) identifying privileged podspec passthrough in Fission Environment CRD mutations.
Data Sources
Required Tables
False Positives & Tuning
- Approved privileged environment configurations for host-level testing workflows
- GitOps controllers periodically re-applying already-approved manifests
- Environment CRDs from unrelated but similarly-named API groups being incorrectly matched
Other platforms for CVE-2026-50564
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Deploy Fission Environment with hostPID and privileged podspec passthrough
Expected signal: Kubernetes API audit log entry (verb=create) for environments.fission.io/atomic-test-hostpid-env containing hostPID:true and securityContext.privileged:true in the request object.
- Test 2Deploy Fission Environment with hostNetwork passthrough
Expected signal: Kubernetes API audit log entry (verb=create) for environments.fission.io/atomic-test-hostnet-env containing hostNetwork:true in the request object.
- Test 3Patch existing Fission Environment to add hostIPC after initial benign creation
Expected signal: Kubernetes API audit log entries for both create and patch verbs on environments.fission.io/atomic-test-patch-env, with the patch event's requestObject containing hostIPC:true and privileged:true.
References (6)
- https://github.com/fission/fission/security/advisories/GHSA-gx55-f84r-v3r7
- https://nvd.nist.gov/vuln/detail/CVE-2026-50564
- https://github.com/fission/fission/pull/3391
- https://github.com/fission/fission/commit/e484df8460bb4e8026e24210120602aa7f181f64
- https://github.com/fission/fission/releases/tag/v1.24.0
- https://github.com/advisories/GHSA-gx55-f84r-v3r7
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50564 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month