CVE-2026-45730

Name of the Vulnerable Software and Affected Versions Nuclio versions 1.15.26 and HEAD commit e185454

Description Nuclio Dashboard contains a missing authorization issue in its project management API. While the read path is correctly protected, the write paths fail to set MemberIds in the PermissionOptions structure. This causes the FilterProjectsByPermissions() function to short-circuit and bypass Open Policy Agent (OPA) authorization checks entirely. Consequently, any authenticated user, regardless of their project membership or privilege level, can modify or delete any project on the platform if they know the project name. This can lead to the cascading deletion of all associated resources, including functions, API gateways, and function events. In Kubernetes deployments, this allows unauthorized modification of the NuclioProject Custom Resource Definition (CRD), potentially affecting function deployment behavior such as node selection and resource quotas.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the PUT /api/projects/{id} and DELETE /api/projects API endpoints to trusted clients only via network-level restrictions or firewall rules.