# CVE-2026-52831: Nuclio command injection in cron trigger event headers and body

Source: https://junglewise.ai/threats/cve-2026-52831-nuclio-command-injection-in-cron-trigger-event-headers-and-body  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-52831 · Severity: critical · CVSS 10 · Published 2026-09-02

Nuclio, an open-source serverless platform, contains a vulnerability in how it handles scheduled tasks (cron triggers). An attacker can provide malicious input that allows them to execute arbitrary commands on the underlying server with root privileges. This could lead to a total takeover of the system, theft of sensitive credentials, and a persistent foothold in the environment that remains even after the original task is deleted.

Technologies: [github.com/nuclio/nuclio (Go)](https://junglewise.ai/threats/technologies/github-com-nuclio-nuclio), [Nuclio](https://junglewise.ai/threats/technologies/nuclio). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Nuclio](https://junglewise.ai/threats/vendors/nuclio).

## Quick answers

**Is CVE-2026-52831 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52831 being exploited in the wild.

**How severe is CVE-2026-52831?** Critical severity, with a CVSS score of 10, published 2 September 2026.

**Which products and versions are affected?** github.com/nuclio/nuclio (Go) < 0.0.0-20260601075854-3356b86a8bfa, SEMVER:introduced=0,fixed=0.0.0-20260601075854-3356b86a8bfa; Nuclio <= 1.15.27.

**Is there a fix for CVE-2026-52831?** Yes. github.com/nuclio/nuclio (Go): upgrade to 0.0.0-20260601075854-3356b86a8bfa or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52831 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-52831?** Check whether you run github.com/nuclio/nuclio (Go) or Nuclio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/nuclio/nuclio (Go): upgrade to 0.0.0-20260601075854-3356b86a8bfa or later

  ```sh
  go get github.com/nuclio/nuclio@v0.0.0-20260601075854-3356b86a8bfa
  ```


## Technical details

The Nuclio controller constructs a shell command for Kubernetes CronJobs by concatenating user-supplied event headers and body content into a 'curl' invocation string. Specifically, 'event.headers' keys are interpolated verbatim into double-quoted arguments, allowing an attacker to break the quoting context with a double-quote character. Additionally, 'event.body' is processed using 'strconv.Quote', which fails to escape shell command substitution characters like '$()'. An attacker can exploit these paths to achieve Remote Code Execution (RCE) as root. Because the resulting CronJobs lack 'ownerReferences', they may persist in the cluster even after the parent NuclioFunction is deleted. The vulnerability is fixed in version 1.16.4.

## Affected products

- Nuclio Nuclio <= 1.15.27

## Identifiers

- CVE-2026-52831
- GHSA-v5px-423j-pf7p
- GO-2026-5946

## Timeline

- 2026-05-17: other: Vulnerability verified on version 1.15.27
- 2026-06-01: patched: Initial patch commit released
- 2026-07-08: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/j311yl0v3u](https://api.github.com/users/j311yl0v3u)
- [https://github.com/j311yl0v3u](https://github.com/j311yl0v3u)
- [https://api.github.com/users/j311yl0v3u/gists%7B/gist_id%7D](https://api.github.com/users/j311yl0v3u/gists%7B/gist_id%7D)
- [https://api.github.com/users/j311yl0v3u/repos](https://api.github.com/users/j311yl0v3u/repos)
- [https://avatars.githubusercontent.com/u/102125416?v=4](https://avatars.githubusercontent.com/u/102125416?v=4)
- [https://api.github.com/users/j311yl0v3u/events%7B/privacy%7D](https://api.github.com/users/j311yl0v3u/events%7B/privacy%7D)

## Related threats

- [Nuclio OS command injection in dashboard namespace validation](https://junglewise.ai/threats/cve-2026-79756-nuclio-os-command-injection-in-dashboard-namespace-validation)
- [Nuclio command injection in Docker platform via namespace filter](https://junglewise.ai/threats/cve-2026-79755-nuclio-command-injection-in-docker-platform-via-namespace-filter)
- [Nuclio Dashboard command injection in Kaniko builder](https://junglewise.ai/threats/cve-2026-79754-nuclio-dashboard-command-injection-in-kaniko-builder)
- [Nuclio code injection in Java runtime build.gradle](https://junglewise.ai/threats/cve-2026-52833-nuclio-code-injection-in-java-runtime-build-gradle)
- [Nuclio Dashboard path traversal in spec.handler allows arbitrary file write](https://junglewise.ai/threats/cve-2026-52832-nuclio-dashboard-path-traversal-in-spec-handler-allows-arbitrary)