CVE-2026-79754

CVE-2026-79754 is a shell command-injection flaw (CWE-77) in Nuclio, an open-source serverless framework for real-time event and data processing, where the Dashboard build pipeline inserts the spec.build.tempDir field into a shell command without sanitization. When the Kaniko container builder is enabled, any user with function-create permission can inject shell metacharacters into that field while creating a function, causing arbitrary commands to execute inside the Dashboard container. The attacker gains code execution in that container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace, allowing theft of Secrets and manipulation of workloads in the namespace. All Nuclio versions from 1.6.19 through versions before 1.17.2 are affected, and the issue is fixed in 1.17.2. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.4% chance of exploitation in the next 30 days, so no exploitation is currently known.

What to do: Upgrade Nuclio to version 1.17.2 or later. If upgrading is not immediately possible, restrict function-create permissions to trusted users, disable or limit the Kaniko container builder, and avoid untrusted values in spec.build.tempDir. Because the Dashboard container holds wildcard service-account access to Secrets, Pods, Jobs, and Deployments in its namespace, also check for untrusted function-create activity and review Secrets in that namespace for signs of compromise.