Arbitrary Command Execution Vulnerability in Nuclio Dashboard

CVE-2026-79754

What is CVE-2026-79754?

The Nuclio Dashboard's build pipeline has a serious vulnerability where it fails to properly sanitize the spec.build.tempDir field. This oversight allows a user with function-create permission to insert shell metacharacters, resulting in arbitrary command execution within the Dashboard container. The impacted container utilizes a Kubernetes service account with extensive access to Secrets, Pods, Jobs, and Deployments, posing significant risks to the integrity of the environment. Users are encouraged to upgrade to version 1.17.2 or later, where the issue has been resolved.

References