Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50566.
Upgrade to ProDetect Fission SecurityContext Bypass Privileged Pod Creation (CVE-2026-50566) in CrowdStrike LogScale
Detects exploitation of CVE-2026-50566, a critical (CVSS 9.9) vulnerability in Fission (<= 1.23.0) where the Environment Runtime.Container and Builder.Container SecurityContext fields can be manipulated to bypass intended pod security restrictions, allowing creation of privileged pods within the Kubernetes cluster. Attackers with Fission Environment/Function CRUD access can escalate to node-level or cluster-level compromise by deploying privileged containers via the executor's pod spec generation, bypassing SecurityContext hardening (e.g. privileged: true, allowPrivilegeEscalation, hostPID, hostNetwork, capabilities such as SYS_ADMIN). This detection focuses on Kubernetes audit log events showing creation/update of Fission Environment CRDs with permissive securityContext blocks and subsequent pod creation events reflecting privileged escalation in namespaces managed by Fission (typically fission-function, fission-builder).
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=K8sAuditEvent
| verb=create OR verb=update OR verb=patch
| objectRefResource=environments OR objectRefResource=pods
| objectRefNamespace=*fission*
| requestObject=*privileged*true* OR requestObject=*allowPrivilegeEscalation*true* OR requestObject=*hostPID*true* OR requestObject=*SYS_ADMIN*
| table([_time, userUsername, verb, objectRefResource, objectRefNamespace, objectRefName, requestObject])CrowdStrike Falcon LogScale/CQL query detecting privileged Fission environment or pod creation events indicative of CVE-2026-50566 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate cluster admin operations requiring privileged containers
- Fission remediation deployments during upgrade to v1.24.0
- Sensor coverage gaps causing partial/duplicate event matches
Other platforms for CVE-2026-50566
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Fission Environment with Privileged SecurityContext
Expected signal: Kubernetes audit log entry showing a 'create' verb against the environments resource in fission-function namespace with requestObject containing privileged:true and allowPrivilegeEscalation:true.
- Test 2Deploy Function Triggering Privileged Pod via Builder Container
Expected signal: Kubernetes audit log showing 'update' verb on environments resource with builder.container.securityContext containing privileged:true and hostPID:true, followed by pod creation events in fission-builder namespace.
- Test 3Verify Privileged Pod Escapes to Host Filesystem
Expected signal: Container runtime and host-level audit logs showing a process from within the fission-function namespace pod performing a chroot/mount operation accessing the host root filesystem (/proc/1/root).
References (6)
- https://github.com/fission/fission/security/advisories/GHSA-m63v-2g9w-2w6v
- https://nvd.nist.gov/vuln/detail/CVE-2026-50566
- https://github.com/fission/fission/pull/3406
- https://github.com/fission/fission/commit/695d3e97e3a20463ab7c8c081843e69e65e952e5
- https://github.com/fission/fission/releases/tag/v1.24.0
- https://github.com/advisories/GHSA-m63v-2g9w-2w6v
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50566 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month