CVE-2026-52832
Received Received - Intake

Nuclio Dashboard Authentication Bypass via Handler Path

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion. This issue has been patched in version 1.16.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-52832
EUVD
EUVD-2026-70215

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nuclio nuclio to 1.16.5 (exc)
nuclio nuclio 1.16.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-52832 is a path traversal vulnerability in Nuclio's Dashboard component. It allows unauthenticated attackers to write arbitrary files to any location within the Dashboard container's filesystem. The issue occurs because the Dashboard exposes an unauthenticated POST /api/functions endpoint by default, and the spec.handler field is parsed without proper path validation. The handler value is split on colons but not checked for path traversal sequences like "../".

Detection Guidance

Check if Nuclio Dashboard is running with unauthenticated access by inspecting network connections to port 8080 or similar. Look for POST requests to /api/functions with handler fields containing path traversal sequences like ../../../../. Use curl to test: curl -X POST http://<dashboard-ip>:<port>/api/functions -d '{"spec":{"handler":"../../../../tmp/test:handler"}}'.

Impact Analysis

This vulnerability allows attackers to write malicious files to sensitive locations like /tmp, /etc, or /usr/local/bin within the Dashboard container. Since the Dashboard runs as root, attackers could gain control over the system by writing files to critical directories. This could lead to arbitrary code execution, data theft, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized modifications, or system compromises, all of which are non-compliant with these regulations. Organizations using affected Nuclio versions must address this to maintain compliance.

Mitigation Strategies

Upgrade Nuclio to version 1.16.5 or later. Enable authentication on the Dashboard if not already set. Restrict network access to the Dashboard port using firewalls or network policies. Run the Dashboard container as a non-root user to limit file write impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52832. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart