CVE-2026-79755
Received Received - Intake

Command Injection in Nuclio Serverless Framework

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=<value>" command that is executed via the host shell (/bin/sh -c). Because the default auth kind is nop (unauthenticated), a remote attacker can inject arbitrary OS commands that run as root inside the dashboard container, which holds the Docker socket → host compromise. This issue has been patched in version 1.17.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-79755
EUVD
EUVD-2026-70218

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nuclio nuclio to 1.17.4 (exc)
nuclio nuclio 1.17.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79755 is an unauthenticated OS command injection vulnerability in the Nuclio local Docker platform affecting versions up to 1.17.2. The issue occurs when a function namespace is interpolated without validation into a shell command executed via /bin/sh -c. Attackers can inject arbitrary OS commands that run as root inside the dashboard container, which has access to the Docker socket, leading to full host compromise.

Detection Guidance

To detect this vulnerability, check if you are running a vulnerable version of Nuclio (prior to 1.17.4) on a local Docker platform. Inspect the Nuclio dashboard container logs for suspicious activity or unexpected command execution. Look for unauthorized namespace labels or filter values in docker ps commands.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands as root on the host system through the Nuclio dashboard container. Since the dashboard has access to the Docker socket, attackers can gain full control over the host, compromising confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability could lead to unauthorized access and control of systems handling sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Full host compromise may result in data breaches, unauthorized data access, or system manipulation, all of which are critical compliance violations.

Mitigation Strategies

Immediately upgrade Nuclio to version 1.17.4 or later. If upgrading is not possible, disable the local Docker platform in Nuclio or restrict access to the dashboard container. Ensure no untrusted functions are running and review all namespace labels for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79755. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart