CVE-2026-52833
HighCVSS 8.0Summary
Nuclio, a serverless framework, prior to version 1.16.5 has a vulnerability in the Java runtime that generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace to break out of the repositories block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase.
Risk Assessment
An attacker can execute arbitrary code during the Gradle configuration phase, potentially leading to build environment compromise and possibly remote code execution.
Recommendation
It is recommended to upgrade to version 1.16.5 or later, which contains the fix.
Other vulnerabilities in Nuclio
See all- CVE-2026-79756High
Nuclio, a serverless framework, prior to version 1.17.4 has an incomplete fix for unauthenticated OS command injection in the dashboard on the local/Docker platform. The list-all resource path interpolates the resourceNamespace parameter unquoted into a /bin/sh -c command string, allowing an unauthenticated attacker to inject shell metacharacters via HTTP headers and execute arbitrary commands inside the dashboard container.
- CVE-2026-79755High
Nuclio, a serverless framework, prior to version 1.17.4 has an OS command injection vulnerability in the local Docker platform. The function namespace is interpolated unvalidated into a double-quoted docker ps --filter command executed via /bin/sh -c. Because the default auth kind is nop (unauthenticated), a remote attacker can inject arbitrary OS commands that run as root inside the dashboard container, which holds the Docker socket, leading to host compromise.
- CVE-2026-79754High
Nuclio, a serverless framework, from version 1.6.19 to before 1.17.2 has a vulnerability in the Dashboard build pipeline that does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permission can inject shell metacharacters and achieve arbitrary command execution inside the Dashboard container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments.
- CVE-2026-52832Medium
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion. This issue has been patched in version 1.16.5.
- CVE-2026-52831High
Nuclio before version 1.16.4 contains a command injection vulnerability in the construction of the curl invocation for cron triggers. The event.headers keys and event.body are not properly sanitized, allowing injection of dangerous arguments into the command executed in the CronJob container.
- CVE-2026-45730High
Nuclio before version 1.16.0 contains a vulnerability in the project management API of Nuclio Dashboard. Any authenticated user, even without membership in the target project, can bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources.
Original NVD description (English source)
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. This issue has been patched in version 1.16.5.