CVE-2026-79756

Name of the Vulnerable Software and Affected Versions Nuclio versions prior to 1.17.4

Description An unauthenticated OS command injection exists in the dashboard of this serverless framework when running on the local/Docker platform. The issue occurs because the list-all resource path interpolates the resourceNamespace parameter unquoted into a /bin/sh -c command string. An attacker can execute arbitrary commands inside the dashboard container by injecting shell metacharacters through the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers.

Recommendations Update to version 1.17.4.