Command Injection Vulnerability in Nuclio Serverless Framework
CVE-2026-52831

8HIGH

Key Information:

Vendor

Nuclio

Status
Nuclio
Vendor
CVE Published:
2 September 2026

What is CVE-2026-52831?

The Nuclio Serverless Framework has a command injection vulnerability that affects versions prior to 1.16.4. The vulnerability arises when the controller builds a curl invocation string for cron triggers without properly sanitizing user inputs from event.headers and event.body. This lack of sufficient input validation can lead to arbitrary code execution in Kubernetes CronJob containers. Users should update to version 1.16.4 or later to mitigate this risk. For further details, consult the security advisory and the release notes.

Affected Version(s)

nuclio < 1.16.4

References

https://github.com/nuclio/nuclio/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/nuclio/nuclio/commit/3356b86a8bfab3f96...
x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.16.4
x_refsource_MISC

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.