Command Injection Vulnerability in Nuclio Serverless Framework
CVE-2026-79755

8HIGH

Key Information:

Vendor

Nuclio

Status
Nuclio
Vendor
CVE Published:
2 September 2026

What is CVE-2026-79755?

A command injection vulnerability exists in the Nuclio Serverless framework for real-time events and data processing. Specifically, prior to version 1.17.4, an unvalidated function namespace is inserted into a Docker command executed via the host shell. This flaw allows remote attackers to inject arbitrary OS commands, potentially gaining root access within the dashboard container, which could lead to a full host compromise. The vulnerability has been addressed in version 1.17.4, highlighting the importance of updating to secure deployments.

Affected Version(s)

nuclio < 1.17.4

References

https://github.com/nuclio/nuclio/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/nuclio/nuclio/pull/4220
x_refsource_MISC
https://github.com/nuclio/nuclio/commit/24582ac354d04951e...
x_refsource_MISC

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.