# CVE-2026-79754: Nuclio Dashboard command injection in Kaniko builder

Source: https://junglewise.ai/threats/cve-2026-79754-nuclio-dashboard-command-injection-in-kaniko-builder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-79754 · Severity: info · CVSS 8.8 · Published 2026-09-02

Nuclio is a serverless framework for building and deploying real-time data processing functions. The Dashboard component's build pipeline fails to properly sanitize user input when constructing shell commands for the Kaniko container builder. An authenticated user with function-creation permissions can inject shell commands through the build configuration, achieving arbitrary code execution inside the Dashboard container, which has broad permissions to access Kubernetes secrets, pods, and deployments in its namespace.

Technologies: [Nuclio](https://junglewise.ai/threats/technologies/nuclio). Vendors: [Nuclio](https://junglewise.ai/threats/vendors/nuclio).

## Quick answers

**Is CVE-2026-79754 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79754 being exploited in the wild.

**How severe is CVE-2026-79754?** Informational severity, with a CVSS score of 8.8, published 2 September 2026.

**Which products and versions are affected?** Nuclio 1.6.19 to before 1.17.2.

**Is there a fix for CVE-2026-79754?** A patch was published on 2026-07-14: Fix merged in commit e3ed7de; version 1.17.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79754 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-79754?** Check whether you run Nuclio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a command injection vulnerability (CWE-77) in Nuclio's Kaniko builder pipeline. The spec.build.tempDir field is passed unsanitized into a tar shell command via string interpolation: `"tar -zcvf %s %s"` executed through `/bin/sh -c`. Although the field was validated against path traversal (..), it lacked protection against shell metacharacters (;|&$`(){}\etc.), allowing an authenticated attacker with function-create permission to break out of the intended command and execute arbitrary shell commands. The Dashboard container runs with a Kubernetes service account holding wildcard permissions to Secrets, Pods, Jobs, and Deployments. The patch (released in version 1.17.2) eliminates the shell interpreter by calling tar directly via exec.CommandContext with discrete string arguments, and adds secondary input validation rejecting shell metacharacters.

## Affected products

- Nuclio Nuclio 1.6.19 to before 1.17.2

## Timeline

- 2026-09-02: disclosed: CVE-2026-79754 published
- 2026-07-14: patched: Fix merged in commit e3ed7de; version 1.17.2 released

## References

- [https://github.com/nuclio/nuclio/commit/e3ed7de65c20c270a2035b7c27b25800e5b1e252](https://github.com/nuclio/nuclio/commit/e3ed7de65c20c270a2035b7c27b25800e5b1e252)
- [https://github.com/nuclio/nuclio/pull/4190](https://github.com/nuclio/nuclio/pull/4190)

## Related threats

- [Nuclio OS command injection in dashboard namespace validation](https://junglewise.ai/threats/cve-2026-79756-nuclio-os-command-injection-in-dashboard-namespace-validation)
- [Nuclio command injection in Docker platform via namespace filter](https://junglewise.ai/threats/cve-2026-79755-nuclio-command-injection-in-docker-platform-via-namespace-filter)
- [Nuclio code injection in Java runtime build.gradle](https://junglewise.ai/threats/cve-2026-52833-nuclio-code-injection-in-java-runtime-build-gradle)
- [Nuclio Dashboard path traversal in spec.handler allows arbitrary file write](https://junglewise.ai/threats/cve-2026-52832-nuclio-dashboard-path-traversal-in-spec-handler-allows-arbitrary)
- [Nuclio command injection in cron trigger event headers and body](https://junglewise.ai/threats/cve-2026-52831-nuclio-command-injection-in-cron-trigger-event-headers-and-body)