Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50566.

Upgrade to Pro
CVE-2026-50566 Google Chronicle · YARA-L

Detect Fission SecurityContext Bypass Privileged Pod Creation (CVE-2026-50566) in Google Chronicle

Detects exploitation of CVE-2026-50566, a critical (CVSS 9.9) vulnerability in Fission (<= 1.23.0) where the Environment Runtime.Container and Builder.Container SecurityContext fields can be manipulated to bypass intended pod security restrictions, allowing creation of privileged pods within the Kubernetes cluster. Attackers with Fission Environment/Function CRUD access can escalate to node-level or cluster-level compromise by deploying privileged containers via the executor's pod spec generation, bypassing SecurityContext hardening (e.g. privileged: true, allowPrivilegeEscalation, hostPID, hostNetwork, capabilities such as SYS_ADMIN). This detection focuses on Kubernetes audit log events showing creation/update of Fission Environment CRDs with permissive securityContext blocks and subsequent pod creation events reflecting privileged escalation in namespaces managed by Fission (typically fission-function, fission-builder).

MITRE ATT&CK

Tactic
Privilege Escalation Initial Access Defense Evasion

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule fission_securitycontext_bypass_cve_2026_50566 {
  meta:
    author = "df00tech"
    description = "Detects privileged pod/environment creation in Fission namespaces consistent with CVE-2026-50566"
    severity = "CRITICAL"
    cve = "CVE-2026-50566"

  events:
    $audit.metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
    $audit.target.resource.resource_type = "CONTAINER"
    $audit.target.namespace contains "fission"
    $audit.about.labels["verb"] in ("create", "update", "patch")
    $audit.about.labels["raw_request"] contains "privileged" or
    $audit.about.labels["raw_request"] contains "allowPrivilegeEscalation" or
    $audit.about.labels["raw_request"] contains "hostPID" or
    $audit.about.labels["raw_request"] contains "SYS_ADMIN"

  condition:
    $audit
}
critical severity medium confidence

Chronicle YARA-L rule to detect Fission Environment/Pod objects created or modified with privileged SecurityContext settings, matching CVE-2026-50566 exploitation.

Data Sources

Kubernetes Audit Logs ingested into Chronicle

Required Tables

audit

False Positives & Tuning

  • Authorized privileged deployments by platform teams
  • Chronicle UDM normalization variance causing benign matches on keyword substrings
  • Test clusters replicating vulnerable configurations for validation purposes

Other platforms for CVE-2026-50566

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Create Fission Environment with Privileged SecurityContext

    Expected signal: Kubernetes audit log entry showing a 'create' verb against the environments resource in fission-function namespace with requestObject containing privileged:true and allowPrivilegeEscalation:true.

  2. Test 2Deploy Function Triggering Privileged Pod via Builder Container

    Expected signal: Kubernetes audit log showing 'update' verb on environments resource with builder.container.securityContext containing privileged:true and hostPID:true, followed by pod creation events in fission-builder namespace.

  3. Test 3Verify Privileged Pod Escapes to Host Filesystem

    Expected signal: Container runtime and host-level audit logs showing a process from within the fission-function namespace pod performing a chroot/mount operation accessing the host root filesystem (/proc/1/root).

Last updated: 2026-07-21 Research depth: standard
References (6)

Unlock playbooks & atomic tests with Pro

Get the full detection package for CVE-2026-50566 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.

df00tech Pro — £29/user/month

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0001Initial AccessTA0005Defense Evasion

Related Techniques

T1611Escape to HostT1610Deploy ContainerT1078.004Cloud Accounts

Same Tactic: Privilege Escalation

Popular Detections