Is CVE-2026-52832 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52832 being exploited in the wild.

How severe is CVE-2026-52832?

Medium severity, with a CVSS score of 4.9, published 2 September 2026.

Which products and versions are affected?

github.com/nuclio/nuclio (Go) < 1.16.5, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.16.5; Nuclio <= 1.15.27.

Is there a fix for CVE-2026-52832?

Yes. github.com/nuclio/nuclio (Go): upgrade to 1.16.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52832 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-52832?

Check whether you run github.com/nuclio/nuclio (Go) or Nuclio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52832: Nuclio Dashboard path traversal in spec.handler allows arbitrary file write

Q: Is there a fix for CVE-2026-52832?

Yes. github.com/nuclio/nuclio (Go): upgrade to 1.16.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-52832 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-52832?

Check whether you run github.com/nuclio/nuclio (Go) or Nuclio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52832 · Severity: medium · CVSS 4.9 · Published 2026-09-02

Nuclio, an open-source serverless platform, contains a vulnerability in its Dashboard component that allows unauthenticated users to write files to any location within the Dashboard's container. Because the Dashboard process runs with administrative (root) privileges, an attacker could overwrite critical system files or configuration settings. This could lead to a complete takeover of the container and potentially allow the attacker to gain broader access to the underlying Kubernetes cluster.

Technologies: github.com/nuclio/nuclio (Go), Nuclio. Vendors: Go, Nuclio.

Quick answers

Is CVE-2026-52832 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52832 being exploited in the wild.
How severe is CVE-2026-52832?: Medium severity, with a CVSS score of 4.9, published 2 September 2026.
Which products and versions are affected?: github.com/nuclio/nuclio (Go) < 1.16.5, SEMVER:introduced=0, SEMVER:introduced=0,fixed=1.16.5; Nuclio <= 1.15.27.
Is there a fix for CVE-2026-52832?: Yes. github.com/nuclio/nuclio (Go): upgrade to 1.16.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52832 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-52832?: Check whether you run github.com/nuclio/nuclio (Go) or Nuclio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/nuclio/nuclio (Go): upgrade to 1.16.5 or later
```
go get github.com/nuclio/nuclio@v1.16.5
```

Technical details

A path traversal vulnerability exists in the Nuclio Dashboard's 'POST /api/functions' endpoint. The 'spec.handler' field is parsed by 'functionconfig.ParseHandler()' without path validation. During the build process, 'writeFunctionSourceCodeToTempFile()' uses 'path.Join' with the attacker-supplied module name, which resolves '../' sequences and allows the resulting path to escape the intended temporary directory. The Dashboard process, running as root, then writes attacker-controlled content to this path using 'os.WriteFile'. This allows for arbitrary file writes within the container filesystem, including sensitive directories like /etc or /usr/local/bin. An attacker can leverage this to achieve code execution or escalate privileges within the Kubernetes namespace using the Dashboard's service account token.

Affected products

Nuclio Nuclio <= 1.15.27

Identifiers

CVE-2026-52832
GHSA-wpcj-rmv4-86qg
GO-2026-6012

Timeline

2026-05-17: disclosed: Vulnerability verified by researcher
2026-06-05: advisory: GitHub Advisory published
2026-07-16: advisory: CVE-2026-52832 published
1.16.5: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.