Is CVE-2026-45730 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45730 being exploited in the wild.

How severe is CVE-2026-45730?

High severity, with a CVSS score of 8.3, published 2 September 2026.

Which products and versions are affected?

github.com/nuclio/nuclio (Go) < 0.0.0-20260513101907-1915cd26d514, SEMVER:introduced=0,fixed=0.0.0-20260513101907-1915cd26d514; Nuclio < 0.0.0-20260513101907-1915cd26d514.

Is there a fix for CVE-2026-45730?

Yes. github.com/nuclio/nuclio (Go): upgrade to 0.0.0-20260513101907-1915cd26d514 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45730 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45730?

Check whether you run github.com/nuclio/nuclio (Go) or Nuclio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45730: Nuclio missing authorization in project write paths

Q: Is there a fix for CVE-2026-45730?

Yes. github.com/nuclio/nuclio (Go): upgrade to 0.0.0-20260513101907-1915cd26d514 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45730 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45730?

Check whether you run github.com/nuclio/nuclio (Go) or Nuclio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45730 · Severity: high · CVSS 8.3 · Published 2026-09-02

Nuclio is an open-source serverless platform used to deploy and manage high-performance functions. A security flaw in its dashboard allows any logged-in user to modify or delete projects they do not own. This could lead to the unauthorized deletion of critical business functions, API gateways, and associated data, potentially causing significant service outages and data loss.

Technologies: github.com/nuclio/nuclio (Go), Nuclio. Vendors: Go, Nuclio.

Quick answers

Is CVE-2026-45730 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45730 being exploited in the wild.
How severe is CVE-2026-45730?: High severity, with a CVSS score of 8.3, published 2 September 2026.
Which products and versions are affected?: github.com/nuclio/nuclio (Go) < 0.0.0-20260513101907-1915cd26d514, SEMVER:introduced=0,fixed=0.0.0-20260513101907-1915cd26d514; Nuclio < 0.0.0-20260513101907-1915cd26d514.
Is there a fix for CVE-2026-45730?: Yes. github.com/nuclio/nuclio (Go): upgrade to 0.0.0-20260513101907-1915cd26d514 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45730 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45730?: Check whether you run github.com/nuclio/nuclio (Go) or Nuclio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/nuclio/nuclio (Go): upgrade to 0.0.0-20260513101907-1915cd26d514 or later
```
go get github.com/nuclio/nuclio@v0.0.0-20260513101907-1915cd26d514
```

Technical details

A vulnerability in Nuclio Dashboard's project management API (CWE-862) allows authenticated users to bypass Open Policy Agent (OPA) authorization checks on write paths. While the read path correctly populates 'MemberIds' for OPA filtering, the 'PUT /api/projects/{id}' and 'DELETE /api/projects' paths fail to set these identifiers. This causes the 'FilterProjectsByPermissions' function in 'pkg/platform/abstract/platform.go' to short-circuit and skip authorization entirely. An attacker with valid credentials can modify project configurations or trigger cascading deletions of Functions, APIGateways, and FunctionEvents. The issue is fixed in version 0.0.0-20260513101907-1915cd26d514.

Affected products

nuclio/nuclio Nuclio < 0.0.0-20260513101907-1915cd26d514

Identifiers

CVE-2026-45730
GHSA-m8xg-8xg9-mxhm
GO-2026-5499

Timeline

2026-05-06: other: Vulnerability verified on latest source and Helm release.
2026-05-13: patched: Fixed in commit 1915cd26d514.
2026-06-01: advisory: GitHub Advisory published.
2026-06-04: disclosed: CVE-2026-45730 assigned.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.