CVE-2026-79754: Nuclio Dashboard command injection in Kaniko builder

Executive brief

Nuclio is a serverless framework for building and deploying real-time data processing functions. The Dashboard component's build pipeline fails to properly sanitize user input when constructing shell commands for the Kaniko container builder. An authenticated user with function-creation permissions can inject shell commands through the build configuration, achieving arbitrary code execution inside the Dashboard container, which has broad permissions to access Kubernetes secrets, pods, and deployments in its namespace.

Technical details

This is a command injection vulnerability (CWE-77) in Nuclio's Kaniko builder pipeline. The spec.build.tempDir field is passed unsanitized into a tar shell command via string interpolation: `"tar -zcvf %s %s"` executed through `/bin/sh -c`. Although the field was validated against path traversal (..), it lacked protection against shell metacharacters (;|& (){}\etc.), allowing an authenticated attacker with function-create permission to break out of the intended command and execute arbitrary shell commands. The Dashboard container runs with a Kubernetes service account holding wildcard permissions to Secrets, Pods, Jobs, and Deployments. The patch (released in version 1.17.2) eliminates the shell interpreter by calling tar directly via exec.CommandContext with discrete string arguments, and adds secondary input validation rejecting shell metacharacters.

Affected products

• Nuclio Nuclio 1.6.19 to before 1.17.2

Timeline

• 2026-09-02: disclosed: CVE-2026-79754 published
• 2026-07-14: patched: Fix merged in commit e3ed7de; version 1.17.2 released

References

• https://github.com/nuclio/nuclio/commit/e3ed7de65c20c270a2035b7c27b25800e5b1e252
• https://github.com/nuclio/nuclio/pull/4190