Executive brief
Nuclio is a serverless framework used to process real-time events and data. The Nuclio dashboard, which runs locally or in Docker, was vulnerable to unauthenticated command injection attacks. An attacker could inject arbitrary shell commands via HTTP headers to gain code execution inside the dashboard container, potentially compromising the framework and any workloads it manages.
Technical details
This is an OS command injection vulnerability in the Nuclio dashboard's list-all resource endpoint. The vulnerability exists in the local/Docker platform implementation where the resourceNamespace parameter is interpolated unquoted into a /bin/sh -c command string. Although a prior fix added input validation for function names and quoted certain command paths, the list-all code path (triggered when no specific resource name is provided) was missed. An unauthenticated attacker can inject shell metacharacters via HTTP headers (X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace) to execute arbitrary commands. The vulnerability requires only network access to the dashboard and no authentication. A patch was released in version 1.17.4.
Affected products
- Nuclio Nuclio prior to 1.17.4
Timeline
- 2026-09-02: disclosed
- 2026-07-27: patched: patch merged in development branch on July 27, 2026