CVE-2026-45730

CVE-2026-45730 is a missing-authorization flaw (CWE-862) in the project management API of the Nuclio Dashboard, the control-plane component of the open-source Nuclio serverless platform for real-time event and data processing. Prior to version 1.16.0, any authenticated user can bypass the OPA (Open Policy Agent) authorization checks on the write paths PUT /api/projects/{id} and DELETE /api/projects, even if that user has no membership in the target project. An attacker with any valid, low-privilege Dashboard account can therefore modify or delete any project along with all of its associated resources, such as functions and API gateways, producing high integrity and availability impact with limited confidentiality impact. All Nuclio deployments running a version before 1.16.0 are affected; risk is highest where non-administrator users can reach the Dashboard, typically in self-hosted, container/Kubernetes-based installations. No public proof-of-concept, no CISA KEV entry, and an EPSS 30-day exploitation probability of about 0.3% (18th percentile) indicate that no active exploitation is currently known.

What to do: Upgrade to Nuclio 1.16.0 or later, where OPA authorization checks on the project write paths (PUT /api/projects/{id}, DELETE /api/projects) are enforced. Until upgraded, restrict Dashboard access to trusted administrative users and review project-management API logs for project modifications or deletions performed by users without membership in the affected projects. Because any authenticated low-privilege account is sufficient to trigger the flaw, also audit which non-administrator users hold Dashboard credentials.