CVE-2026-52831
Received Received - Intake

Remote Code Execution in Nuclio Serverless Framework

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, <command>). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This issue has been patched in version 1.16.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-52831
EUVD
EUVD-2026-70220

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nuclio nuclio to 1.16.4 (exc)
nuclio nuclio to 1.15.27 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a shell command injection vulnerability in Nuclio's cron trigger functionality. It occurs when the Nuclio controller builds a curl command string for Kubernetes CronJobs without properly sanitizing user input from event headers and body. Attackers can inject malicious shell commands through header keys containing double quotes or event bodies using command substitution syntax like $(...). The vulnerability allows arbitrary code execution as root in CronJob pods.

Detection Guidance

Check Nuclio version with: kubectl get deployment -n <namespace> <nuclio-deployment> -o jsonpath='{.spec.template.spec.containers[0].image}'. If version is <=1.15.27, it is vulnerable. Inspect CronJob specs for cron triggers to see if they use /bin/sh -c with concatenated curl commands.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary commands on your system with root privileges. This could lead to data theft, system compromise, or establishing persistent backdoors. Attackers only need network access to the Dashboard API to exploit this issue. The impact is severe as commands run as root and persist even after the original NuclioFunction is deleted due to the CronJob lacking owner references.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful exploit could lead to data breaches, unauthorized data access, or system modifications that violate these regulations. Organizations would need to report any breaches and implement additional security measures to maintain compliance.

Mitigation Strategies

Upgrade Nuclio to version 1.16.4 or later immediately. If upgrading is not possible, disable cron triggers in NuclioFunction configurations. Ensure any custom cron trigger images include curl on the PATH. Review existing CronJobs for signs of compromise.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52831. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart