Unauthenticated OS Command Injection in Nuclio Dashboard

CVE-2026-79756

What is CVE-2026-79756?

Nuclio, a serverless framework for real-time events and data processing, has an OS command injection vulnerability in its dashboard for versions prior to 1.17.4. An attacker exploiting this flaw can inject shell metacharacters through specific HTTP headers, leading to arbitrary command execution within the dashboard container. Although a fix has been introduced in version 1.17.4 to mitigate this issue, it is essential for users to update their installations to protect against possible exploitations.

References