CVE-2026-52831 Details
Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, <command>). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This issue has been patched in version 1.16.4.
A shell injection vulnerability has been identified in the Nuclio serverless framework, specifically in versions through 1.15.27. The issue arises in the Cron trigger implementation, where user-supplied header keys and event bodies are concatenated into a shell command without proper sanitization. This allows for command injection, with the potential for arbitrary code execution on the affected system.
Users can update to Nuclio version 1.16.4 or later, where this vulnerability has been patched. If an immediate update is not possible, consider placing the Nuclio Dashboard behind an authenticated reverse proxy or restricting access to trusted networks. Additionally, remove the 'batch' API group permission from the Nuclio controller ServiceAccount to prevent CronJob creation, although this will disable cron trigger functionality entirely.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 2, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nuclio/nuclio/commit/3356b86a8bfab3f960aa420310ebff765df9dede | [email protected] | Source CodeVendor |
| https://github.com/nuclio/nuclio/releases/tag/1.16.4 | [email protected] | Release NotesVendor |
| https://github.com/nuclio/nuclio/security/advisories/GHSA-v5px-423j-pf7p | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nuclio | <= 1.15.27 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | New CVE Received | [email protected] |