Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50566.
Upgrade to ProDetect Fission SecurityContext Bypass Privileged Pod Creation (CVE-2026-50566) in Microsoft Sentinel
Detects exploitation of CVE-2026-50566, a critical (CVSS 9.9) vulnerability in Fission (<= 1.23.0) where the Environment Runtime.Container and Builder.Container SecurityContext fields can be manipulated to bypass intended pod security restrictions, allowing creation of privileged pods within the Kubernetes cluster. Attackers with Fission Environment/Function CRUD access can escalate to node-level or cluster-level compromise by deploying privileged containers via the executor's pod spec generation, bypassing SecurityContext hardening (e.g. privileged: true, allowPrivilegeEscalation, hostPID, hostNetwork, capabilities such as SYS_ADMIN). This detection focuses on Kubernetes audit log events showing creation/update of Fission Environment CRDs with permissive securityContext blocks and subsequent pod creation events reflecting privileged escalation in namespaces managed by Fission (typically fission-function, fission-builder).
MITRE ATT&CK
KQL Detection Query
let PrivilegedFlags = dynamic(["privileged","allowPrivilegeEscalation","hostPID","hostNetwork","hostIPC","SYS_ADMIN"]);
KubeAuditLogs
| where Verb in ("create","update","patch")
| where ObjectRef_Resource in ("environments","pods")
| where ObjectRef_Namespace has_any ("fission-function", "fission-builder", "fission")
| where RequestObject has_any (PrivilegedFlags)
| extend PodName = tostring(ObjectRef_Name), Namespace = tostring(ObjectRef_Namespace), User = tostring(User_Username)
| where RequestObject has "true" and (RequestObject has "privileged" or RequestObject has "allowPrivilegeEscalation")
| project TimeGenerated, User, Verb, ObjectRef_Resource, Namespace, PodName, RequestObject
| order by TimeGenerated descDetects Kubernetes API audit events where Fission Environment or Pod objects in fission-managed namespaces are created/modified with permissive SecurityContext fields indicating exploitation of CVE-2026-50566.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate cluster administrators intentionally deploying privileged workloads for infrastructure components (CNI, storage drivers)
- Fission upgrade to patched version 1.24.0 which may still show securityContext fields during migration
- CI/CD pipelines that deploy privileged debug/test environments in non-production clusters
Other platforms for CVE-2026-50566
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Fission Environment with Privileged SecurityContext
Expected signal: Kubernetes audit log entry showing a 'create' verb against the environments resource in fission-function namespace with requestObject containing privileged:true and allowPrivilegeEscalation:true.
- Test 2Deploy Function Triggering Privileged Pod via Builder Container
Expected signal: Kubernetes audit log showing 'update' verb on environments resource with builder.container.securityContext containing privileged:true and hostPID:true, followed by pod creation events in fission-builder namespace.
- Test 3Verify Privileged Pod Escapes to Host Filesystem
Expected signal: Container runtime and host-level audit logs showing a process from within the fission-function namespace pod performing a chroot/mount operation accessing the host root filesystem (/proc/1/root).
References (6)
- https://github.com/fission/fission/security/advisories/GHSA-m63v-2g9w-2w6v
- https://nvd.nist.gov/vuln/detail/CVE-2026-50566
- https://github.com/fission/fission/pull/3406
- https://github.com/fission/fission/commit/695d3e97e3a20463ab7c8c081843e69e65e952e5
- https://github.com/fission/fission/releases/tag/v1.24.0
- https://github.com/advisories/GHSA-m63v-2g9w-2w6v
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50566 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month