Fission SecurityContext Bypass Privileged Pod Creation (CVE-2026-50566)

let PrivilegedFlags = dynamic(["privileged","allowPrivilegeEscalation","hostPID","hostNetwork","hostIPC","SYS_ADMIN"]);
KubeAuditLogs
| where Verb in ("create","update","patch")
| where ObjectRef_Resource in ("environments","pods")
| where ObjectRef_Namespace has_any ("fission-function", "fission-builder", "fission")
| where RequestObject has_any (PrivilegedFlags)
| extend PodName = tostring(ObjectRef_Name), Namespace = tostring(ObjectRef_Namespace), User = tostring(User_Username)
| where RequestObject has "true" and (RequestObject has "privileged" or RequestObject has "allowPrivilegeEscalation")
| project TimeGenerated, User, Verb, ObjectRef_Resource, Namespace, PodName, RequestObject
| order by TimeGenerated desc

index=kubernetes sourcetype="kube:audit"
| search (objectRef.resource="environments" OR objectRef.resource="pods")
| search (verb="create" OR verb="update" OR verb="patch")
| search objectRef.namespace IN ("fission-function","fission-builder","fission")
| search (requestObject="*privileged*true*" OR requestObject="*allowPrivilegeEscalation*true*" OR requestObject="*hostPID*true*" OR requestObject="*hostNetwork*true*" OR requestObject="*SYS_ADMIN*")
| table _time, user.username, verb, objectRef.resource, objectRef.namespace, objectRef.name, requestObject
| sort -_time

any where event.dataset == "kubernetes.audit" and
  kubernetes.audit.verb in ("create", "update", "patch") and
  kubernetes.audit.objectRef.resource in ("environments", "pods") and
  kubernetes.audit.objectRef.namespace : ("fission-function", "fission-builder", "fission") and
  (kubernetes.audit.requestObject : "*privileged*true*" or
   kubernetes.audit.requestObject : "*allowPrivilegeEscalation*true*" or
   kubernetes.audit.requestObject : "*hostPID*true*" or
   kubernetes.audit.requestObject : "*SYS_ADMIN*")

SELECT UTF8(payload) AS RawEvent, "objectRef.namespace" AS Namespace, "objectRef.name" AS ObjectName, "verb" AS Verb, "user.username" AS User
FROM events
WHERE LOGSOURCETYPENAME(devicetype) = 'Kubernetes Audit'
AND ("objectRef.resource" = 'environments' OR "objectRef.resource" = 'pods')
AND ("verb" = 'create' OR "verb" = 'update' OR "verb" = 'patch')
AND ("objectRef.namespace" ILIKE '%fission%')
AND (UTF8(payload) ILIKE '%privileged%true%' OR UTF8(payload) ILIKE '%allowPrivilegeEscalation%true%' OR UTF8(payload) ILIKE '%hostPID%true%' OR UTF8(payload) ILIKE '%SYS_ADMIN%')
LAST 24 HOURS

_sourceCategory=kubernetes/audit
| json field=_raw "verb", "objectRef.resource", "objectRef.namespace", "objectRef.name", "user.username", "requestObject" as verb, resource, namespace, objname, user, reqobj
| where (resource="environments" or resource="pods")
| where (verb="create" or verb="update" or verb="patch")
| where namespace matches "*fission*"
| where (reqobj matches "*privileged*true*" or reqobj matches "*allowPrivilegeEscalation*true*" or reqobj matches "*hostPID*true*" or reqobj matches "*SYS_ADMIN*")
| fields _messagetime, user, verb, resource, namespace, objname, reqobj
| sort by _messagetime

rule fission_securitycontext_bypass_cve_2026_50566 {
  meta:
    author = "df00tech"
    description = "Detects privileged pod/environment creation in Fission namespaces consistent with CVE-2026-50566"
    severity = "CRITICAL"
    cve = "CVE-2026-50566"

  events:
    $audit.metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
    $audit.target.resource.resource_type = "CONTAINER"
    $audit.target.namespace contains "fission"
    $audit.about.labels["verb"] in ("create", "update", "patch")
    $audit.about.labels["raw_request"] contains "privileged" or
    $audit.about.labels["raw_request"] contains "allowPrivilegeEscalation" or
    $audit.about.labels["raw_request"] contains "hostPID" or
    $audit.about.labels["raw_request"] contains "SYS_ADMIN"

  condition:
    $audit
}

#event_simpleName=K8sAuditEvent
| verb=create OR verb=update OR verb=patch
| objectRefResource=environments OR objectRefResource=pods
| objectRefNamespace=*fission*
| requestObject=*privileged*true* OR requestObject=*allowPrivilegeEscalation*true* OR requestObject=*hostPID*true* OR requestObject=*SYS_ADMIN*
| table([_time, userUsername, verb, objectRefResource, objectRefNamespace, objectRefName, requestObject])