CVE-2026-50566: Fission SecurityContext Bypass Enables Privileged Pod Creation

What the Vulnerability Is

CVE-2026-50566 is a critical severity (CVSS 9.9) security control bypass in the Fission serverless framework for Kubernetes. The root cause (CWE-250, execution with unnecessary privileges, and CWE-269, improper privilege management) lies in how Fission generates pod specs for its Environment Runtime.Container and Builder.Container. The securityContext fields on these containers can be manipulated by an attacker to override intended restrictions, allowing values such as privileged: true, allowPrivilegeEscalation, hostPID, hostNetwork, or dangerous capabilities like SYS_ADMIN to pass through into the pods actually scheduled by Fission's executor. The impact is severe: an attacker who can create or modify Fission Environment or Function custom resources can escalate from namespace-scoped access to node-level or full cluster compromise by having Fission itself stand up a privileged container on their behalf.

Affected Software

• Project: github.com/fission/fission
• Affected versions: <= 1.23.0
• No patched version is currently listed in our tracking.

Exploitation Status

This vulnerability is currently tracked as PoC public — a working proof-of-concept exploit has been disclosed, but there are no confirmed reports of in-the-wild weaponization or KEV listing at this time. Defenders should treat this as an elevated-priority item: public PoCs meaningfully shorten the window before opportunistic exploitation, particularly in multi-tenant Kubernetes environments where Fission Environment/Function CRUD access may be granted more broadly than cluster-admin.

How Our Detection Catches It

Our detection logic targets Kubernetes audit log telemetry, correlating two signal types: creation or update events on Fission Environment CRDs that carry permissive securityContext blocks, and subsequent pod creation events in Fission-managed namespaces (typically fission-function and fission-builder) that reflect privileged escalation flags actually landing on the running pod. This before/after correlation reduces noise versus alerting on either signal in isolation. We ship this coverage across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL), so teams can deploy the equivalent logic regardless of which SIEM ingests their Kubernetes audit logs.

Full Detection Details

For the complete, ready-to-deploy queries across all seven supported SIEM platforms, along with MITRE ATT&CK mapping and additional context, see the full detection page for CVE-2026-50566.