Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50566.
Upgrade to ProDetect Fission SecurityContext Bypass Privileged Pod Creation (CVE-2026-50566) in Elastic Security
Detects exploitation of CVE-2026-50566, a critical (CVSS 9.9) vulnerability in Fission (<= 1.23.0) where the Environment Runtime.Container and Builder.Container SecurityContext fields can be manipulated to bypass intended pod security restrictions, allowing creation of privileged pods within the Kubernetes cluster. Attackers with Fission Environment/Function CRUD access can escalate to node-level or cluster-level compromise by deploying privileged containers via the executor's pod spec generation, bypassing SecurityContext hardening (e.g. privileged: true, allowPrivilegeEscalation, hostPID, hostNetwork, capabilities such as SYS_ADMIN). This detection focuses on Kubernetes audit log events showing creation/update of Fission Environment CRDs with permissive securityContext blocks and subsequent pod creation events reflecting privileged escalation in namespaces managed by Fission (typically fission-function, fission-builder).
MITRE ATT&CK
Elastic Detection Query
any where event.dataset == "kubernetes.audit" and
kubernetes.audit.verb in ("create", "update", "patch") and
kubernetes.audit.objectRef.resource in ("environments", "pods") and
kubernetes.audit.objectRef.namespace : ("fission-function", "fission-builder", "fission") and
(kubernetes.audit.requestObject : "*privileged*true*" or
kubernetes.audit.requestObject : "*allowPrivilegeEscalation*true*" or
kubernetes.audit.requestObject : "*hostPID*true*" or
kubernetes.audit.requestObject : "*SYS_ADMIN*")Elastic EQL query to detect creation of privileged Fission environments or pods indicative of CVE-2026-50566 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Cluster infra components legitimately requiring privileged mode
- Manual admin troubleshooting sessions using privileged debug pods
- Fission version upgrade activities that temporarily surface old securityContext values
Other platforms for CVE-2026-50566
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Fission Environment with Privileged SecurityContext
Expected signal: Kubernetes audit log entry showing a 'create' verb against the environments resource in fission-function namespace with requestObject containing privileged:true and allowPrivilegeEscalation:true.
- Test 2Deploy Function Triggering Privileged Pod via Builder Container
Expected signal: Kubernetes audit log showing 'update' verb on environments resource with builder.container.securityContext containing privileged:true and hostPID:true, followed by pod creation events in fission-builder namespace.
- Test 3Verify Privileged Pod Escapes to Host Filesystem
Expected signal: Container runtime and host-level audit logs showing a process from within the fission-function namespace pod performing a chroot/mount operation accessing the host root filesystem (/proc/1/root).
References (6)
- https://github.com/fission/fission/security/advisories/GHSA-m63v-2g9w-2w6v
- https://nvd.nist.gov/vuln/detail/CVE-2026-50566
- https://github.com/fission/fission/pull/3406
- https://github.com/fission/fission/commit/695d3e97e3a20463ab7c8c081843e69e65e952e5
- https://github.com/fission/fission/releases/tag/v1.24.0
- https://github.com/advisories/GHSA-m63v-2g9w-2w6v
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50566 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month