Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50564.

Upgrade to Pro
CVE-2026-50564 Sumo Logic CSE · Sumo

Detect Fission Environment CRD PodSpec Passthrough Node Escape (CVE-2026-50564) in Sumo Logic CSE

Fission (<=1.23.0) allows the Environment Custom Resource podspec passthrough (poolspec.container / poolspec.podspec) to inject arbitrary Kubernetes PodSpec fields including hostPID, hostNetwork, hostIPC, and privileged securityContext into builder/executor pods created by the fission-builder and fission-router controllers. Any principal able to create or update Environment CRDs (which in many multi-tenant Fission deployments includes low-privileged function developers) can escalate to full node compromise by scheduling a privileged, host-namespace-sharing pod, then pivoting to the underlying kubelet, container runtime socket, or other pods on the node. CVSS 9.9.

MITRE ATT&CK

Tactic
Privilege Escalation Lateral Movement Initial Access

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=kubernetes/audit
("fission.io/environment" OR "environments.fission.io")
and ("hostPID" or "hostNetwork" or "hostIPC" or "privileged\":true")
| json field=_raw "verb" as verb
| json field=_raw "user.username" as requestUser
| json field=_raw "objectRef.namespace" as namespace
| where verb in ("create", "update", "patch")
| fields _messagetime, requestUser, namespace, verb, _raw
| sort by _messagetime asc
critical severity medium confidence

Sumo Logic search over Kubernetes audit log source category detecting privileged podspec passthrough written into Fission Environment CRDs.

Data Sources

Kubernetes API Audit Logs

Required Tables

kubernetes/audit

False Positives & Tuning

  • Approved infrastructure teams deploying privileged environments for legitimate hardware access
  • Repeated CI/CD reconciliation of an already-approved privileged environment definition
  • Log source misclassification pulling in non-Fission CRDs matching field names

Other platforms for CVE-2026-50564

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Deploy Fission Environment with hostPID and privileged podspec passthrough

    Expected signal: Kubernetes API audit log entry (verb=create) for environments.fission.io/atomic-test-hostpid-env containing hostPID:true and securityContext.privileged:true in the request object.

  2. Test 2Deploy Fission Environment with hostNetwork passthrough

    Expected signal: Kubernetes API audit log entry (verb=create) for environments.fission.io/atomic-test-hostnet-env containing hostNetwork:true in the request object.

  3. Test 3Patch existing Fission Environment to add hostIPC after initial benign creation

    Expected signal: Kubernetes API audit log entries for both create and patch verbs on environments.fission.io/atomic-test-patch-env, with the patch event's requestObject containing hostIPC:true and privileged:true.

Last updated: 2026-07-18 Research depth: standard
References (6)

Unlock playbooks & atomic tests with Pro

Get the full detection package for CVE-2026-50564 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.

df00tech Pro — £29/user/month

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0008Lateral MovementTA0001Initial Access

Related Techniques

T1611Escape to HostT1610Deploy ContainerT1078.004Cloud Accounts

Same Tactic: Privilege Escalation

Popular Detections