CVE-2026-79754
Received Received - Intake

Command Injection in Nuclio Dashboard

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permission can inject shell metacharacters into this field and achieve arbitrary command execution inside the Dashboard container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace. This issue has been patched in version 1.17.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-79754
EUVD
EUVD-2026-70217

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nuclio nuclio From 1.6.19 (inc) to 1.17.2 (exc)
nuclio nuclio 1.17.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79754 is a command injection vulnerability in Nuclio's Dashboard build pipeline affecting versions 1.6.19 to 1.17.1. It occurs because the spec.build.tempDir field is not sanitized for shell metacharacters before being used in a shell command during the Kaniko container build process. An attacker with function-create permissions can inject shell metacharacters into this field, leading to arbitrary command execution within the Dashboard container.

Detection Guidance

To detect this vulnerability, check if your Nuclio Dashboard version is between 1.6.19 and 1.17.1. Inspect logs for suspicious function creation attempts with shell metacharacters in the spec.build.tempDir field. Look for commands like tar -zcvf with unquoted variables in Kaniko builder logs.

Impact Analysis

This vulnerability allows an attacker with function-create permissions to execute arbitrary commands inside the Dashboard container. Since the container runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace, it could lead to full cluster compromise, unauthorized data access, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, including personal or health information, if exploited. The Dashboard container runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace, potentially allowing full cluster compromise. This may violate GDPR's data protection requirements and HIPAA's security rules regarding unauthorized access to protected health information.

Mitigation Strategies

Upgrade Nuclio to version 1.17.2 or later immediately. Disable the Kaniko builder if not required. Review Kubernetes service account permissions for the Dashboard container to ensure least privilege. Monitor for unauthorized function creation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79754. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart