Is CVE-2026-52831 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52831 being exploited in the wild.

How severe is CVE-2026-52831?

Critical severity, with a CVSS score of 10, published 2 September 2026.

Which products and versions are affected?

github.com/nuclio/nuclio (Go) < 0.0.0-20260601075854-3356b86a8bfa, SEMVER:introduced=0,fixed=0.0.0-20260601075854-3356b86a8bfa; Nuclio <= 1.15.27.

Is there a fix for CVE-2026-52831?

Yes. github.com/nuclio/nuclio (Go): upgrade to 0.0.0-20260601075854-3356b86a8bfa or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52831 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-52831?

Check whether you run github.com/nuclio/nuclio (Go) or Nuclio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52831: Nuclio command injection in cron trigger event headers and body

Q: Is there a fix for CVE-2026-52831?

Yes. github.com/nuclio/nuclio (Go): upgrade to 0.0.0-20260601075854-3356b86a8bfa or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-52831 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-52831?

Check whether you run github.com/nuclio/nuclio (Go) or Nuclio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52831 · Severity: critical · CVSS 10 · Published 2026-09-02

Nuclio, an open-source serverless platform, contains a vulnerability in how it handles scheduled tasks (cron triggers). An attacker can provide malicious input that allows them to execute arbitrary commands on the underlying server with root privileges. This could lead to a total takeover of the system, theft of sensitive credentials, and a persistent foothold in the environment that remains even after the original task is deleted.

Technologies: github.com/nuclio/nuclio (Go), Nuclio. Vendors: Go, Nuclio.

Quick answers

Is CVE-2026-52831 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52831 being exploited in the wild.
How severe is CVE-2026-52831?: Critical severity, with a CVSS score of 10, published 2 September 2026.
Which products and versions are affected?: github.com/nuclio/nuclio (Go) < 0.0.0-20260601075854-3356b86a8bfa, SEMVER:introduced=0,fixed=0.0.0-20260601075854-3356b86a8bfa; Nuclio <= 1.15.27.
Is there a fix for CVE-2026-52831?: Yes. github.com/nuclio/nuclio (Go): upgrade to 0.0.0-20260601075854-3356b86a8bfa or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52831 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-52831?: Check whether you run github.com/nuclio/nuclio (Go) or Nuclio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/nuclio/nuclio (Go): upgrade to 0.0.0-20260601075854-3356b86a8bfa or later
```
go get github.com/nuclio/nuclio@v0.0.0-20260601075854-3356b86a8bfa
```

Technical details

The Nuclio controller constructs a shell command for Kubernetes CronJobs by concatenating user-supplied event headers and body content into a 'curl' invocation string. Specifically, 'event.headers' keys are interpolated verbatim into double-quoted arguments, allowing an attacker to break the quoting context with a double-quote character. Additionally, 'event.body' is processed using 'strconv.Quote', which fails to escape shell command substitution characters like '$()'. An attacker can exploit these paths to achieve Remote Code Execution (RCE) as root. Because the resulting CronJobs lack 'ownerReferences', they may persist in the cluster even after the parent NuclioFunction is deleted. The vulnerability is fixed in version 1.16.4.

Affected products

Nuclio Nuclio <= 1.15.27

Identifiers

CVE-2026-52831
GHSA-v5px-423j-pf7p
GO-2026-5946

Timeline

2026-05-17: other: Vulnerability verified on version 1.15.27
2026-06-01: patched: Initial patch commit released
2026-07-08: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.