CVE-2026-45730
Received Received - Intake

Authenticated Project Deletion in Nuclio Dashboard

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-45730
EUVD
EUVD-2026-70212

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nuclio nuclio to 1.16.0 (exc)
nuclio nuclio 1.16.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45730 is a vulnerability in Nuclio Dashboard's project management API that allows any authenticated user to modify or delete any project, even without membership in the target project. The issue stems from missing authorization checks on write paths (PUT /api/projects/{id} and DELETE /api/projects), where the system fails to populate the MemberIds field in PermissionOptions, causing the OPA authorization check to be bypassed.

Detection Guidance

To detect this vulnerability, check if your Nuclio Dashboard is running a version prior to 1.16.0. Use commands like 'curl -s http://<nuclio-dashboard-address>/api/version' to verify the installed version. If the version is below 1.16.0, the system is vulnerable.

Impact Analysis

This vulnerability allows low-privilege users to alter or delete projects and their associated resources like functions and API gateways. The exploit requires no special technical skills, as the attack chain involves sending direct HTTP requests to vulnerable endpoints. This could lead to data loss, service disruption, or unauthorized access to sensitive resources.

Compliance Impact

This vulnerability could lead to unauthorized modification or deletion of projects and associated resources, potentially violating data integrity and access control requirements under GDPR and HIPAA. Unauthorized changes to sensitive data or systems may result in non-compliance with these regulations.

Mitigation Strategies

Immediately upgrade Nuclio to version 1.16.0 or later. This version includes the necessary authorization checks to prevent unauthorized project modifications. Follow the official upgrade instructions from the Nuclio documentation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45730. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart