CVE-2026-52831: Nuclio Serverless Framework RCE Vulnerability

CVE-2026-52831 Overview

Nuclio is an open-source serverless framework for real-time events and data processing. The Nuclio controller constructs a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container using /bin/sh, -c, <command>. Two fields in the trigger specification, event.headers keys and event.body, flow into this shell command without adequate sanitization. An authenticated attacker with permission to define cron triggers can inject arbitrary shell commands that execute inside the CronJob container. The issue is fixed in version 1.16.4 and is tracked as [CWE-78] OS Command Injection.

Critical Impact

Attackers with high-privilege access to function definitions can achieve arbitrary command execution within the Kubernetes CronJob container spawned by Nuclio.

Affected Products

• Nuclio serverless framework versions prior to 1.16.4
• Nuclio controller component (pkg/platform/kube/functionres/lazy.go)
• Kubernetes deployments using Nuclio cron triggers

Discovery Timeline

• 2026-09-02 - CVE-2026-52831 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-52831

Vulnerability Analysis

The Nuclio controller generates a shell command string for each cron trigger and passes it to a Kubernetes CronJob container as args under /bin/sh -c. The command uses curl to invoke the function endpoint and embeds attacker-controllable fields directly into the string. Both event.headers map keys and the event.body value are concatenated without escaping or quoting.

Because the resulting string is executed by /bin/sh, standard shell metacharacters such as backticks, $(), ;, &&, and | are interpreted by the shell interpreter. An attacker who can create or modify a cron trigger can therefore break out of the intended curl command and execute arbitrary shell commands inside the CronJob container. Execution runs with the service account and network context of the Nuclio-managed CronJob workload, which can be leveraged for lateral movement within the cluster.

Root Cause

The controller builds a shell command by string concatenation instead of passing arguments as a properly structured exec array or applying shell-safe escaping. Header names and body contents are treated as trusted data despite being user-controllable through the trigger specification.

Attack Vector

Exploitation requires network access to the Nuclio API and privileges sufficient to define a function with a cron trigger. The attacker supplies a crafted event.headers key or event.body containing shell metacharacters. When Kubernetes runs the resulting CronJob, /bin/sh executes the injected payload alongside the intended curl request.

// Security patch in pkg/platform/kube/functionres/lazy.go
// [Security] Fix cron trigger shell injection (#4139)

// Prepare the new cron job object
cronJobMeta := metav1.ObjectMeta{
    Name:      kube.CronJobName(),
    Namespace: function.Namespace,
// ...
}

Source: GitHub Commit 3356b86. The patch restructures how the controller assembles the CronJob command so that user-supplied header keys and body content no longer reach /bin/sh -c unescaped.

Detection Methods for CVE-2026-52831

Indicators of Compromise

• Kubernetes CronJob objects in Nuclio-managed namespaces whose container args contain shell metacharacters such as `, $(, ;, &&, or | alongside curl invocations.
• CronJob execution logs showing processes other than curl spawned by /bin/sh -c.
• Function or trigger definitions containing unusual header names or body payloads with embedded shell syntax.

Detection Strategies

• Audit all Nuclio function specifications with cron triggers and compare stored event.headers and event.body values against an allow-list of expected characters.
• Inspect the rendered CronJob YAML for each Nuclio function and flag args[2] strings that deviate from the expected curl template.
• Enable Kubernetes audit logging for create and update operations on CronJob resources in Nuclio namespaces and correlate them with the originating function definition.

Monitoring Recommendations

• Monitor CronJob pod process trees for child processes of /bin/sh that are not curl, using runtime security tooling.
• Alert on outbound network connections from Nuclio CronJob pods to destinations other than the target function service.
• Track Nuclio API authentication events and privilege changes for accounts able to create or modify cron triggers.

How to Mitigate CVE-2026-52831

Immediate Actions Required

• Upgrade Nuclio to version 1.16.4 or later in all clusters running the controller.
• Review existing cron-triggered functions and delete or recreate any with suspicious header keys or body values.
• Restrict Nuclio API privileges so that only trusted service accounts can create or modify function triggers.

Patch Information

The fix is included in Nuclio Release 1.16.4 and applied in commit 3356b86. Additional context is available in the GitHub Security Advisory GHSA-v5px-423j-pf7p. The patch replaces the vulnerable shell-string construction in pkg/platform/kube/functionres/lazy.go used to build CronJob container arguments.

Workarounds

• Disable cron triggers on Nuclio deployments that cannot be upgraded immediately.
• Enforce Kubernetes admission controls that reject CronJob objects whose container args contain shell metacharacters.
• Apply Role-Based Access Control (RBAC) policies limiting who can submit function specifications to the Nuclio controller.

# Verify the running Nuclio controller version and list CronJobs created for cron triggers
kubectl -n nuclio get deploy nuclio-controller -o jsonpath='{.spec.template.spec.containers[0].image}'
kubectl get cronjobs --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}{"/"}{.metadata.name}{": "}{.spec.jobTemplate.spec.template.spec.containers[0].args}{"\n"}{end}'