CVE-2026-45730: Nuclio Dashboard Auth Bypass Vulnerability

CVE-2026-45730 Overview

CVE-2026-45730 is a broken access control vulnerability in the Nuclio Dashboard project management API. Nuclio is a serverless framework for real-time events and data processing. Prior to version 1.16.0, the dashboard fails to enforce Open Policy Agent (OPA) authorization checks on write paths, including PUT /api/projects/{id} and DELETE /api/projects. Any authenticated user, even without membership in the target project, can modify or delete arbitrary projects along with associated functions and API gateways. The issue maps to [CWE-862: Missing Authorization] and was patched in Nuclio 1.16.0.

Critical Impact
Authenticated users can bypass OPA authorization on project write operations to delete or alter any project and cascade destruction to its functions and API gateways.

Affected Products

Nuclio serverless framework versions prior to 1.16.0
Nuclio Dashboard project management API endpoints
Kubernetes-based Nuclio platform deployments

Discovery Timeline

2026-09-02 - CVE-2026-45730 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-45730

Vulnerability Analysis

The vulnerability resides in the Nuclio Dashboard's project resource handler and the underlying Kubernetes platform layer. Write operations invoked through PUT /api/projects/{id} and DELETE /api/projects did not pass member identity or a forbidden-on-deny flag into the OPA permission query. As a result, OPA policy evaluation was effectively bypassed for update and delete actions. Any user holding a valid session cookie could target projects owned by other tenants. Because Nuclio projects are containers for functions, API gateways, triggers, and other runtime assets, deletion cascades across all dependent resources.

Root Cause

The root cause is missing authorization enforcement in the project write paths. The handler in pkg/dashboard/resource/project.go constructed PermissionOptions without populating MemberIds from the authenticated session and without setting RaiseForbidden to true. The platform code in pkg/platform/kube/platform.go did not invoke QueryOPAProjectPermissions before performing the create, update, or delete operation. OPA received insufficient context to deny non-members, so the checks silently passed.

Attack Vector

Exploitation requires network access to the Nuclio Dashboard API and any authenticated session. The attacker sends a crafted PUT or DELETE request targeting a project they do not belong to. The server processes the request, skips effective OPA evaluation, and applies the change directly to the Kubernetes backend.

// Patch: pkg/dashboard/resource/project.go
		RequestOrigin: requestOrigin,
		SessionCookie: sessionCookie,
		PermissionOptions: opaclient.PermissionOptions{
+			MemberIds:           opa.GetUserAndGroupIdsFromAuthSession(pr.getCtxSession(ctx)),
+			RaiseForbidden:      true,
			OverrideHeaderValue: request.Header.Get(headers.ProjectsRole),
		},
	}); err != nil {

// Patch: pkg/platform/kube/platform.go
+	// check OPA permissions
+	permissionOptions := createProjectOptions.PermissionOptions
+	permissionOptions.RaiseForbidden = true
+	if _, err := p.QueryOPAProjectPermissions(ctx,
+		createProjectOptions.ProjectConfig.Meta.Name,
+		opaclient.ActionCreate,
+		&permissionOptions); err != nil {
+		return errors.Wrap(err, "Failed to authorize project creation")
+	}

Source: Nuclio commit 1915cd26

Detection Methods for CVE-2026-45730

Indicators of Compromise

Unexpected DELETE /api/projects or PUT /api/projects/{id} requests from user sessions with no prior read activity against the target project.
Kubernetes audit events showing bulk removal of Nuclio NuclioFunction, NuclioAPIGateway, or NuclioProject custom resources in short time windows.
Nuclio Dashboard access logs showing write operations against projects where the caller is not listed in project membership metadata.

Detection Strategies

Correlate Nuclio Dashboard HTTP access logs with authenticated user identity and project ownership metadata to flag cross-tenant writes.
Alert on OPA decision logs where authorization queries for project actions are absent immediately before a successful project modification.
Baseline normal project lifecycle activity per user and identify deviations such as delete storms or role header (x-projects-role) tampering.

Monitoring Recommendations

Forward Nuclio Dashboard, OPA decision, and Kubernetes API server audit logs to a centralized analytics platform for correlation.
Track the version of Nuclio deployed across clusters and alert when instances run below 1.16.0.
Monitor for anomalous spikes in NuclioFunction and NuclioAPIGateway deletions tied to a single session token.

How to Mitigate CVE-2026-45730

Immediate Actions Required

Upgrade all Nuclio deployments to version 1.16.0 or later, which contains the authorization fix from pull request #4107.
Rotate any authenticated session cookies and API credentials that could have been used against unpatched dashboards.
Audit existing projects, functions, and API gateways for unauthorized modifications or deletions.

Patch Information

The fix is available in the Nuclio 1.16.0 release. The patch adds MemberIds and RaiseForbidden to PermissionOptions on write paths and invokes QueryOPAProjectPermissions in the Kubernetes platform layer before create, update, or delete operations. Full details are documented in the GitHub Security Advisory GHSA-m8xg-8xg9-mxhm.

Workarounds

Restrict network access to the Nuclio Dashboard API to trusted administrators using ingress policies or an authenticating reverse proxy until the upgrade is complete.
Reduce the number of authenticated dashboard users and enforce least-privilege session issuance while the vulnerable version is running.
Enable Kubernetes RBAC restrictions on the Nuclio custom resource definitions to add a defense-in-depth control against unauthorized project deletion.

bash

# Verify installed Nuclio version and upgrade
kubectl -n nuclio get deploy nuclio-dashboard -o jsonpath='{.spec.template.spec.containers[0].image}'

# Upgrade via Helm to a fixed release
helm repo update
helm upgrade nuclio nuclio/nuclio \
  --namespace nuclio \
  --version 1.16.0