CVE-2026-52832: Nuclio Dashboard Auth Bypass Vulnerability

CVE-2026-52832 Overview

CVE-2026-52832 is a path traversal vulnerability [CWE-22] in Nuclio, an open-source serverless framework for real-time events and data processing. In versions prior to 1.16.5, the Nuclio Dashboard exposes POST /api/functions without authentication by default when running in NOP auth mode. The spec.handler field, parsed by functionconfig.ParseHandler(), splits input on : without validating the module portion. Attackers can supply ../ sequences in the handler module name to write function source code outside the intended temporary build directory. The issue is patched in Nuclio 1.16.5.

Critical Impact
An authenticated attacker with high privileges can write attacker-controlled source code to arbitrary filesystem locations, compromising build environment integrity and enabling downstream code execution during function builds.

Affected Products

Nuclio Serverless Framework versions prior to 1.16.5
Nuclio Dashboard component (POST /api/functions endpoint)
Deployments running in NOP authentication mode (default configuration)

Discovery Timeline

2026-09-02 - CVE-2026-52832 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-52832

Vulnerability Analysis

The vulnerability resides in Nuclio's function build pipeline. When a client submits a function specification, the spec.handler field encodes a module name and function name separated by a colon (for example, mymodule:myfunction). The functionconfig.ParseHandler() routine splits this string on : and returns the module portion verbatim, without normalizing or validating the path.

In pkg/processor/build/builder.go, the builder constructs a source file path using path.Join(tempDir, moduleFileName) and then writes decoded function source code to that location. Because path.Join cleans but does not confine the result, a moduleFileName containing ../ traversal sequences resolves to a location outside tempDir. The result is an arbitrary file write primitive scoped to the Dashboard process's filesystem permissions.

Root Cause

The root cause is missing path containment validation on attacker-influenced input before a filesystem write. spec.handler is treated as trusted structured data rather than untrusted user input. The Dashboard's default NOP auth mode compounds the exposure by not gating the POST /api/functions endpoint behind authentication, though the CVSS vector requires high privileges (PR:H), indicating exploitation still requires access to submit function definitions.

Attack Vector

An attacker who can reach the Dashboard API submits a crafted function specification with a traversal-laden handler such as ../../etc/cron.d/payload:handler. During the build phase, Nuclio decodes the base64-encoded source code and writes it to the resolved path, planting attacker content outside the sandboxed build directory.

// Security patch: IsPathWithinDir helper added to pkg/common/helper.go
// Resolves both paths to absolute form and rejects traversal sequences.
func IsPathWithinDir(targetPath, dir string) (bool, error) {
	absTargetPath, err := filepath.Abs(targetPath)
	if err != nil {
		return false, errors.Wrap(err, "Failed to resolve target path")
	}
	absDir, err := filepath.Abs(dir)
	if err != nil {
		return false, errors.Wrap(err, "Failed to resolve dir")
	}

	relPath, err := filepath.Rel(absDir, absTargetPath)
	if err != nil {
		// paths share no common base (e.g. different Windows volumes) - not within
		return false, nil
	}

	return relPath != "." &&
		relPath != ".." &&
		!strings.HasPrefix(relPath, ".."+string(os.PathSeparator)), nil
}

// Guard applied in pkg/processor/build/builder.go before os.WriteFile:
sourceFilePath := path.Join(tempDir, moduleFileName)
withinTempDir, err := common.IsPathWithinDir(sourceFilePath, tempDir)
if err != nil {
	return "", errors.Wrap(err, "Failed to validate source file path")
}
if !withinTempDir {
	return "", errors.Errorf("Handler module name resolves outside the build directory: %s", moduleFileName)
}

Source: Nuclio commit 2a55d3a

Detection Methods for CVE-2026-52832

Indicators of Compromise

HTTP POST requests to /api/functions on the Nuclio Dashboard containing ../ or URL-encoded %2e%2e%2f sequences within the spec.handler JSON field.
Unexpected files appearing outside Nuclio's build temp directories, particularly in system paths such as /etc/, /var/, or user home directories.
Nuclio Dashboard log entries showing successful function creation with unusual handler module names containing path separators.

Detection Strategies

Inspect Dashboard API request bodies for spec.handler values whose module portion (before :) contains path separators or traversal tokens.
Correlate Nuclio Dashboard access logs with filesystem write events on the Dashboard host to identify writes originating from the builder process to locations outside expected temp directories.
Alert on any Dashboard exposure where the auth mode is set to nop, since this is the default vulnerable configuration.

Monitoring Recommendations

Enable and centralize Nuclio Dashboard access logs, capturing the full request body for POST /api/functions operations.
Monitor the Dashboard process for os.WriteFile activity outside its designated temp directory using file integrity monitoring or eBPF-based syscall tracing.
Track deployed Nuclio versions across the environment and flag any instance running below 1.16.5.

How to Mitigate CVE-2026-52832

Immediate Actions Required

Upgrade Nuclio to version 1.16.5 or later, which introduces the IsPathWithinDir containment check.
Change the Dashboard authentication mode from nop to a supported authenticated mode and restrict network access to trusted operators only.
Audit filesystem locations on Dashboard hosts for unauthorized files written since the vulnerable version was deployed.

Patch Information

The fix is available in Nuclio Release 1.16.5. The corrective changes are described in Pull Request #4143 and GitHub Security Advisory GHSA-wpcj-rmv4-86qg. The patch adds a helper that resolves both the target file and the temp directory to absolute paths and rejects any resolved path that falls outside the build directory.

Workarounds

Place the Dashboard behind an authenticating reverse proxy that enforces identity checks before requests reach /api/functions.
Apply network segmentation and firewall rules to limit Dashboard reachability to trusted CI/CD systems and administrator workstations.
Run the Dashboard process under a least-privilege account with a restricted filesystem view to reduce the blast radius of a successful traversal write.

bash

# Configuration example: verify installed version and upgrade
kubectl -n nuclio get deployment nuclio-dashboard -o jsonpath='{.spec.template.spec.containers[0].image}'

# Upgrade to patched release via Helm
helm repo update
helm upgrade nuclio nuclio/nuclio \
  --namespace nuclio \
  --set dashboard.image.tag=1.16.5 \
  --set dashboard.auth.mode=iguazio  # replace 'nop' with a real auth mode