PT-2026-84822 · Nuclio · Nuclio
CVE-2026-79754
·
Published
2026-09-02
·
Updated
2026-09-02
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Nuclio versions 1.6.19 through 1.17.1
Description
The Dashboard build pipeline fails to sanitize the
spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permissions can inject shell metacharacters into this field to execute arbitrary commands within the Dashboard container. This container operates using a Kubernetes service account that possesses wildcard access to Secrets, Pods, Jobs, and Deployments within its namespace.Recommendations
Update to version 1.17.2.
Exploit
Fix
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nuclio