Executive brief
Nuclio, an open-source serverless platform, contains a vulnerability in its Java function builder. An unauthenticated attacker can send a specially crafted request to the Dashboard API that injects malicious code into the build process. This allows the attacker to execute arbitrary commands as a root user within the build environment, potentially leading to the theft of cloud credentials, tampering with software artifacts, or further access into the internal network.
Technical details
The vulnerability exists in 'pkg/processor/build/runtime/java/runtime.go' where the 'createGradleBuildScript' function uses Go's 'text/template' package to generate a 'build.gradle' file. The 'runtimeAttributes.repositories' field is rendered using the '{{ . }}' action without any escaping or validation. An attacker can provide a string containing a closing brace '}' to break out of the 'repositories' block and inject arbitrary Groovy statements. These statements are executed unconditionally by Gradle during the configuration phase. Since the Dashboard API often runs with NOP authentication by default, this can be exploited without credentials. The build container typically runs as root, and depending on the environment, may have access to Kubernetes ServiceAccount tokens or cloud instance metadata (IMDS).
Affected products
- Nuclio Nuclio <= 1.15.27
Timeline
- 2026-05-17: other: Vulnerability dynamically verified on version 1.15.27
- 2026-06-05: advisory: GitHub Advisory published
- 2026-07-16: disclosed: CVE-2026-52833 assigned
- 1.16.5: patched: Fixed in version 1.16.5