CVE-2026-79756

Nuclio, an open-source "serverless" framework for real-time event and data processing, ships a dashboard whose earlier fix for unauthenticated OS command injection on the local/Docker platform is incomplete. On the list-all resource path (taken when no specific resource name is provided), the resourceNamespace parameter is still interpolated unquoted into a /bin/sh -c command string, allowing unauthenticated attackers to inject shell metacharacters via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers. A successful injection yields arbitrary command execution inside the dashboard container (CVSS 4.0: 8.7 High, network-exploitable with no privileges or user interaction required). Anyone running a Nuclio dashboard prior to version 1.17.4 on the local/Docker platform is affected, especially if the dashboard is reachable from an untrusted network. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS estimates a 5.1% probability of exploitation within 30 days (92nd percentile).

What to do: Upgrade Nuclio to version 1.17.4 or later, which completes the fix by properly quoting the resource namespace on the list-all path. Until patched, ensure the dashboard is not reachable from untrusted networks (restrict via firewall or require authentication in front of it), since exploitation requires no credentials. Operators of unpatched dashboards on the local/Docker platform should review container logs and running processes for signs of unexpected shell command activity.