Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50566.
Upgrade to ProDetect Fission SecurityContext Bypass Privileged Pod Creation (CVE-2026-50566) in IBM QRadar
Detects exploitation of CVE-2026-50566, a critical (CVSS 9.9) vulnerability in Fission (<= 1.23.0) where the Environment Runtime.Container and Builder.Container SecurityContext fields can be manipulated to bypass intended pod security restrictions, allowing creation of privileged pods within the Kubernetes cluster. Attackers with Fission Environment/Function CRUD access can escalate to node-level or cluster-level compromise by deploying privileged containers via the executor's pod spec generation, bypassing SecurityContext hardening (e.g. privileged: true, allowPrivilegeEscalation, hostPID, hostNetwork, capabilities such as SYS_ADMIN). This detection focuses on Kubernetes audit log events showing creation/update of Fission Environment CRDs with permissive securityContext blocks and subsequent pod creation events reflecting privileged escalation in namespaces managed by Fission (typically fission-function, fission-builder).
MITRE ATT&CK
QRadar Detection Query
SELECT UTF8(payload) AS RawEvent, "objectRef.namespace" AS Namespace, "objectRef.name" AS ObjectName, "verb" AS Verb, "user.username" AS User
FROM events
WHERE LOGSOURCETYPENAME(devicetype) = 'Kubernetes Audit'
AND ("objectRef.resource" = 'environments' OR "objectRef.resource" = 'pods')
AND ("verb" = 'create' OR "verb" = 'update' OR "verb" = 'patch')
AND ("objectRef.namespace" ILIKE '%fission%')
AND (UTF8(payload) ILIKE '%privileged%true%' OR UTF8(payload) ILIKE '%allowPrivilegeEscalation%true%' OR UTF8(payload) ILIKE '%hostPID%true%' OR UTF8(payload) ILIKE '%SYS_ADMIN%')
LAST 24 HOURSQRadar AQL search for Kubernetes audit events revealing privileged pod/environment creation in Fission namespaces, matching CVE-2026-50566 exploitation patterns.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate privileged workloads from infrastructure teams
- Non-malicious test deployments in staging namespaces named similarly to fission
- Log source misclassification causing benign audit events to match keyword filters
Other platforms for CVE-2026-50566
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Fission Environment with Privileged SecurityContext
Expected signal: Kubernetes audit log entry showing a 'create' verb against the environments resource in fission-function namespace with requestObject containing privileged:true and allowPrivilegeEscalation:true.
- Test 2Deploy Function Triggering Privileged Pod via Builder Container
Expected signal: Kubernetes audit log showing 'update' verb on environments resource with builder.container.securityContext containing privileged:true and hostPID:true, followed by pod creation events in fission-builder namespace.
- Test 3Verify Privileged Pod Escapes to Host Filesystem
Expected signal: Container runtime and host-level audit logs showing a process from within the fission-function namespace pod performing a chroot/mount operation accessing the host root filesystem (/proc/1/root).
References (6)
- https://github.com/fission/fission/security/advisories/GHSA-m63v-2g9w-2w6v
- https://nvd.nist.gov/vuln/detail/CVE-2026-50566
- https://github.com/fission/fission/pull/3406
- https://github.com/fission/fission/commit/695d3e97e3a20463ab7c8c081843e69e65e952e5
- https://github.com/fission/fission/releases/tag/v1.24.0
- https://github.com/advisories/GHSA-m63v-2g9w-2w6v
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50566 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month