CVE-2026-79756 Details
Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote() for the named-resource shell command path, but the list-all resource path (triggered when no specific resource name is provided) still interpolates the resourceNamespace parameter unquoted into a /bin/sh -c command string. An unauthenticated attacker can inject shell metacharacters via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers to achieve arbitrary command execution inside the dashboard container. This issue has been patched in version 1.17.4.
A vulnerability allowing unauthenticated OS command injection has been identified in the Nuclio dashboard component on the local/Docker platform, in versions prior to 1.17.4. This vulnerability arises because the fix for a previous command injection issue was incomplete. While the named-resource shell command path was properly sanitized, the list-all resource path still allowed unquoted interpolation of the resourceNamespace parameter into a shell command. An unauthenticated attacker could exploit this by injecting shell metacharacters through specific HTTP headers, leading to arbitrary command execution within the dashboard container. Since this container has access to the Docker socket, the exploitation could result in a full host compromise.
Users can upgrade to Nuclio version 1.17.4 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 2, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nuclio/nuclio/commit/86d4e39387d8845f567649201798800830f08411 | [email protected] | Source CodeVendor |
| https://github.com/nuclio/nuclio/pull/4223 | [email protected] | Source CodeVendor |
| https://github.com/nuclio/nuclio/releases/tag/1.17.4 | [email protected] | Release NotesVendor |
| https://github.com/nuclio/nuclio/security/advisories/GHSA-mq8w-f7w8-5rgg | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nuclio | <= 1.17.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | New CVE Received | [email protected] |