Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-50566.
Upgrade to ProDetect Fission SecurityContext Bypass Privileged Pod Creation (CVE-2026-50566) in Splunk
Detects exploitation of CVE-2026-50566, a critical (CVSS 9.9) vulnerability in Fission (<= 1.23.0) where the Environment Runtime.Container and Builder.Container SecurityContext fields can be manipulated to bypass intended pod security restrictions, allowing creation of privileged pods within the Kubernetes cluster. Attackers with Fission Environment/Function CRUD access can escalate to node-level or cluster-level compromise by deploying privileged containers via the executor's pod spec generation, bypassing SecurityContext hardening (e.g. privileged: true, allowPrivilegeEscalation, hostPID, hostNetwork, capabilities such as SYS_ADMIN). This detection focuses on Kubernetes audit log events showing creation/update of Fission Environment CRDs with permissive securityContext blocks and subsequent pod creation events reflecting privileged escalation in namespaces managed by Fission (typically fission-function, fission-builder).
MITRE ATT&CK
SPL Detection Query
index=kubernetes sourcetype="kube:audit"
| search (objectRef.resource="environments" OR objectRef.resource="pods")
| search (verb="create" OR verb="update" OR verb="patch")
| search objectRef.namespace IN ("fission-function","fission-builder","fission")
| search (requestObject="*privileged*true*" OR requestObject="*allowPrivilegeEscalation*true*" OR requestObject="*hostPID*true*" OR requestObject="*hostNetwork*true*" OR requestObject="*SYS_ADMIN*")
| table _time, user.username, verb, objectRef.resource, objectRef.namespace, objectRef.name, requestObject
| sort -_timeIdentifies Splunk-ingested Kubernetes audit events showing privileged pod/environment creation within Fission namespaces, consistent with CVE-2026-50566 SecurityContext bypass exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Authorized privileged workloads deployed by cluster operators (monitoring agents, CNI plugins)
- Test/staging clusters that intentionally run permissive Fission environments
- Automated remediation scripts re-applying Fission environment specs during patching
Other platforms for CVE-2026-50566
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Fission Environment with Privileged SecurityContext
Expected signal: Kubernetes audit log entry showing a 'create' verb against the environments resource in fission-function namespace with requestObject containing privileged:true and allowPrivilegeEscalation:true.
- Test 2Deploy Function Triggering Privileged Pod via Builder Container
Expected signal: Kubernetes audit log showing 'update' verb on environments resource with builder.container.securityContext containing privileged:true and hostPID:true, followed by pod creation events in fission-builder namespace.
- Test 3Verify Privileged Pod Escapes to Host Filesystem
Expected signal: Container runtime and host-level audit logs showing a process from within the fission-function namespace pod performing a chroot/mount operation accessing the host root filesystem (/proc/1/root).
References (6)
- https://github.com/fission/fission/security/advisories/GHSA-m63v-2g9w-2w6v
- https://nvd.nist.gov/vuln/detail/CVE-2026-50566
- https://github.com/fission/fission/pull/3406
- https://github.com/fission/fission/commit/695d3e97e3a20463ab7c8c081843e69e65e952e5
- https://github.com/fission/fission/releases/tag/v1.24.0
- https://github.com/advisories/GHSA-m63v-2g9w-2w6v
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-50566 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month