Authentication Bypass in Nuclio Serverless Framework
CVE-2026-52832

4.9MEDIUM

Key Information:

Vendor

Nuclio

Status
Nuclio
Vendor
CVE Published:
2 September 2026

What is CVE-2026-52832?

The Nuclio Serverless Framework prior to version 1.16.5 has a significant vulnerability where the Dashboard exposes the POST /api/functions endpoint without authentication by default. This lack of authentication allows unauthorized users to call the API, potentially leading to unauthorized access and execution of functions. The issue arises from the way the spec.handler field is processed, as it lacks proper path validation on the module portion. This vulnerability has been addressed in version 1.16.5.

Affected Version(s)

nuclio < 1.16.5

References

https://github.com/nuclio/nuclio/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4143
x_refsource_MISC
https://github.com/nuclio/nuclio/commit/2a55d3a8bd4d49226...
x_refsource_MISC

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.