Executive brief
Nuclio is an open-source serverless platform used to deploy and manage high-performance functions. A security flaw in its dashboard allows any logged-in user to modify or delete projects they do not own. This could lead to the unauthorized deletion of critical business functions, API gateways, and associated data, potentially causing significant service outages and data loss.
Technical details
A vulnerability in Nuclio Dashboard's project management API (CWE-862) allows authenticated users to bypass Open Policy Agent (OPA) authorization checks on write paths. While the read path correctly populates 'MemberIds' for OPA filtering, the 'PUT /api/projects/{id}' and 'DELETE /api/projects' paths fail to set these identifiers. This causes the 'FilterProjectsByPermissions' function in 'pkg/platform/abstract/platform.go' to short-circuit and skip authorization entirely. An attacker with valid credentials can modify project configurations or trigger cascading deletions of Functions, APIGateways, and FunctionEvents. The issue is fixed in version 0.0.0-20260513101907-1915cd26d514.
Affected products
- nuclio/nuclio Nuclio < 0.0.0-20260513101907-1915cd26d514
Timeline
- 2026-05-06: other: Vulnerability verified on latest source and Helm release.
- 2026-05-13: patched: Fixed in commit 1915cd26d514.
- 2026-06-01: advisory: GitHub Advisory published.
- 2026-06-04: disclosed: CVE-2026-45730 assigned.