# CVE-2026-45730: Nuclio missing authorization in project write paths

Source: https://junglewise.ai/threats/cve-2026-45730-nuclio-missing-authorization-in-project-write-paths  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-45730 · Severity: high · CVSS 8.3 · Published 2026-09-02

Nuclio is an open-source serverless platform used to deploy and manage high-performance functions. A security flaw in its dashboard allows any logged-in user to modify or delete projects they do not own. This could lead to the unauthorized deletion of critical business functions, API gateways, and associated data, potentially causing significant service outages and data loss.

Technologies: [github.com/nuclio/nuclio (Go)](https://junglewise.ai/threats/technologies/github-com-nuclio-nuclio), [Nuclio](https://junglewise.ai/threats/technologies/nuclio). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Nuclio](https://junglewise.ai/threats/vendors/nuclio).

## Quick answers

**Is CVE-2026-45730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45730 being exploited in the wild.

**How severe is CVE-2026-45730?** High severity, with a CVSS score of 8.3, published 2 September 2026.

**Which products and versions are affected?** github.com/nuclio/nuclio (Go) < 0.0.0-20260513101907-1915cd26d514, SEMVER:introduced=0,fixed=0.0.0-20260513101907-1915cd26d514; Nuclio < 0.0.0-20260513101907-1915cd26d514.

**Is there a fix for CVE-2026-45730?** Yes. github.com/nuclio/nuclio (Go): upgrade to 0.0.0-20260513101907-1915cd26d514 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45730 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45730?** Check whether you run github.com/nuclio/nuclio (Go) or Nuclio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/nuclio/nuclio (Go): upgrade to 0.0.0-20260513101907-1915cd26d514 or later

  ```sh
  go get github.com/nuclio/nuclio@v0.0.0-20260513101907-1915cd26d514
  ```


## Technical details

A vulnerability in Nuclio Dashboard's project management API (CWE-862) allows authenticated users to bypass Open Policy Agent (OPA) authorization checks on write paths. While the read path correctly populates 'MemberIds' for OPA filtering, the 'PUT /api/projects/{id}' and 'DELETE /api/projects' paths fail to set these identifiers. This causes the 'FilterProjectsByPermissions' function in 'pkg/platform/abstract/platform.go' to short-circuit and skip authorization entirely. An attacker with valid credentials can modify project configurations or trigger cascading deletions of Functions, APIGateways, and FunctionEvents. The issue is fixed in version 0.0.0-20260513101907-1915cd26d514.

## Affected products

- nuclio/nuclio Nuclio < 0.0.0-20260513101907-1915cd26d514

## Identifiers

- CVE-2026-45730
- GHSA-m8xg-8xg9-mxhm
- GO-2026-5499

## Timeline

- 2026-05-06: other: Vulnerability verified on latest source and Helm release.
- 2026-05-13: patched: Fixed in commit 1915cd26d514.
- 2026-06-01: advisory: GitHub Advisory published.
- 2026-06-04: disclosed: CVE-2026-45730 assigned.

## References

- [https://api.github.com/users/j311yl0v3u](https://api.github.com/users/j311yl0v3u)
- [https://github.com/j311yl0v3u](https://github.com/j311yl0v3u)
- [https://api.github.com/users/j311yl0v3u/gists%7B/gist_id%7D](https://api.github.com/users/j311yl0v3u/gists%7B/gist_id%7D)
- [https://api.github.com/users/j311yl0v3u/repos](https://api.github.com/users/j311yl0v3u/repos)
- [https://avatars.githubusercontent.com/u/102125416?v=4](https://avatars.githubusercontent.com/u/102125416?v=4)
- [https://api.github.com/users/j311yl0v3u/events%7B/privacy%7D](https://api.github.com/users/j311yl0v3u/events%7B/privacy%7D)

## Related threats

- [Nuclio OS command injection in dashboard namespace validation](https://junglewise.ai/threats/cve-2026-79756-nuclio-os-command-injection-in-dashboard-namespace-validation)
- [Nuclio command injection in Docker platform via namespace filter](https://junglewise.ai/threats/cve-2026-79755-nuclio-command-injection-in-docker-platform-via-namespace-filter)
- [Nuclio Dashboard command injection in Kaniko builder](https://junglewise.ai/threats/cve-2026-79754-nuclio-dashboard-command-injection-in-kaniko-builder)
- [Nuclio code injection in Java runtime build.gradle](https://junglewise.ai/threats/cve-2026-52833-nuclio-code-injection-in-java-runtime-build-gradle)
- [Nuclio Dashboard path traversal in spec.handler allows arbitrary file write](https://junglewise.ai/threats/cve-2026-52832-nuclio-dashboard-path-traversal-in-spec-handler-allows-arbitrary)