CVE-2026-79756
Received Received - Intake

Unauthenticated OS Command Injection in Nuclio Dashboard

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote() for the named-resource shell command path, but the list-all resource path (triggered when no specific resource name is provided) still interpolates the resourceNamespace parameter unquoted into a /bin/sh -c command string. An unauthenticated attacker can inject shell metacharacters via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers to achieve arbitrary command execution inside the dashboard container. This issue has been patched in version 1.17.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-79756
EUVD
EUVD-2026-70219

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nuclio nuclio to 1.17.4 (inc)
nuclio nuclio to 1.17.4 (exc)
nuclio nuclio 1.17.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79756 is an unauthenticated OS command injection flaw in Nuclio versions up to 1.17.3. It affects the local/Docker platform where an attacker can inject shell metacharacters via HTTP headers like X-Nuclio-Function-Namespace to execute arbitrary commands in the dashboard container. The root cause is unquoted interpolation of the resourceNamespace parameter in a shell command.

Detection Guidance

To detect this vulnerability, check if you are running Nuclio versions prior to 1.17.4. Inspect HTTP headers in requests to the Nuclio dashboard for suspicious values in X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace. Monitor for unexpected shell command execution or unauthorized access attempts in logs.

Impact Analysis

An attacker can exploit this to execute arbitrary commands as root within the dashboard container. Since the container has access to the Docker socket, this could lead to full host compromise on the local platform. Kubernetes deployments are unaffected.

Compliance Impact

This vulnerability could lead to unauthorized access and execution of arbitrary commands on the host system via the Nuclio dashboard container, potentially compromising sensitive data. For GDPR, this may result in unauthorized data access or processing, violating principles of lawfulness and security. For HIPAA, it could expose protected health information to unauthorized parties, violating safeguards for electronic protected health information.

Mitigation Strategies

Immediately upgrade Nuclio to version 1.17.4 or later. If upgrading is not possible, restrict access to the Nuclio dashboard and block untrusted HTTP headers. Ensure the dashboard container does not have access to the Docker socket to limit potential host compromise.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79756. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart