CVE-2026-79754: Nuclio Dashboard RCE Vulnerability

CVE-2026-79754 Overview

Nuclio is a serverless framework for real-time events and data processing. CVE-2026-79754 is a command injection vulnerability [CWE-77] in the Nuclio Dashboard build pipeline. The Dashboard does not sanitize the spec.build.tempDir field before interpolating it into a shell command. When the Kaniko container builder is enabled, an authenticated user with function-create permission can inject shell metacharacters into this field to execute arbitrary commands inside the Dashboard container. The Dashboard container runs with a Kubernetes service account that holds wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace. The issue affects versions 1.6.19 through versions prior to 1.17.2 and is patched in 1.17.2.

Critical Impact
Authenticated attackers can execute arbitrary commands inside the Dashboard container and abuse its Kubernetes service account to read Secrets and control Pods, Jobs, and Deployments across the namespace.

Affected Products

Nuclio versions 1.6.19 through 1.17.1
Deployments with the Kaniko container image builder enabled
Nuclio Dashboard component running in Kubernetes

Discovery Timeline

2026-09-02 - CVE-2026-79754 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-79754

Vulnerability Analysis

The Nuclio Dashboard exposes an API that accepts function specifications including a spec.build.tempDir value. This value flows into a shell command string that the Dashboard executes when the Kaniko builder path is taken. Because the field is not validated for shell metacharacters, characters such as ;, |, &, `, $(), and whitespace change the semantics of the constructed command. Any user permitted to create functions can craft a tempDir payload that appends attacker-controlled commands to the build invocation.

Execution occurs inside the Dashboard pod. The Dashboard's Kubernetes service account is bound with wildcard verbs on Secrets, Pods, Jobs, and Deployments in its namespace. An attacker leverages the in-cluster token at /var/run/secrets/kubernetes.io/serviceaccount/token to read secrets, launch pods, or modify workloads without leaving the container.

Root Cause

The root cause is unsafe construction of a shell command through string interpolation of user-supplied input passed to /bin/sh -c. Nuclio lacked a helper to reject or escape POSIX shell metacharacters before this input reached the Kaniko invocation path in pkg/containerimagebuilderpusher/kaniko.go.

Attack Vector

The attacker sends an authenticated function-create request to the Dashboard API. The request body contains a spec.build.tempDir value embedding shell metacharacters. When the Dashboard executes the Kaniko build step, the injected commands run in the Dashboard container with its service account privileges.

// Patch: pkg/common/helper.go — new metacharacter guard
// Source: https://github.com/nuclio/nuclio/commit/e3ed7de65c20c270a2035b7c27b25800e5b1e252

// ContainsShellMetacharacters reports whether the given string contains characters that
// have special meaning to a POSIX shell (/bin/sh -c). Such characters must never appear
// in values that are interpolated into a shell command string.
func ContainsShellMetacharacters(s string) bool {
    return strings.ContainsAny(s, ";|&$`(){}\\\"' \t\n*?[]<>~!")
}

The companion change in pkg/containerimagebuilderpusher/kaniko.go moves toward argument-based execution via os/exec and bytes buffering rather than string-concatenated shell commands. See the GitHub Security Advisory GHSA-x44h-qmrv-mh72 and GitHub Pull Request #4190 for the full remediation.

Detection Methods for CVE-2026-79754

Indicators of Compromise

Function create or update API calls to the Nuclio Dashboard containing shell metacharacters (;, |, &, `, $(, {, }, *, ?, <, >) inside spec.build.tempDir.
Unexpected child processes of the Dashboard container such as sh, curl, wget, kubectl, or nc.
Access to /var/run/secrets/kubernetes.io/serviceaccount/token from processes other than the Dashboard binary.
New Pods, Jobs, or Deployments created by the Dashboard service account outside of normal function deploy patterns.

Detection Strategies

Inspect Nuclio Dashboard access logs for function specification payloads that include shell metacharacters in build fields.
Alert on Kubernetes audit events where the Dashboard service account performs get or list on Secrets it does not normally touch.
Monitor process lineage inside the Dashboard pod and flag executions that do not descend from the expected Kaniko workflow.

Monitoring Recommendations

Enable Kubernetes audit logging at the Metadata level or higher for the Nuclio namespace and forward events to a SIEM.
Baseline the outbound network destinations of the Dashboard pod and alert on deviations that could indicate data exfiltration.
Track container image builds and correlate build parameters with the requesting user identity.

How to Mitigate CVE-2026-79754

Immediate Actions Required

Upgrade Nuclio to version 1.17.2 or later in every environment where the Dashboard is reachable.
Restrict Dashboard access to trusted networks and authenticated administrators until the upgrade is complete.
Rotate any Kubernetes Secrets in the Nuclio namespace that may have been readable by the Dashboard service account.
Review recent function specifications for suspicious spec.build.tempDir values and audit Kubernetes activity performed by the Dashboard service account.

Patch Information

The fix is included in Nuclio 1.17.2. See the GitHub Release 1.17.2 and the GitHub Commit Details. The patch adds a ContainsShellMetacharacters helper in pkg/common/helper.go and refactors the Kaniko invocation in pkg/containerimagebuilderpusher/kaniko.go to avoid unsafe shell interpolation.

Workarounds

Disable the Kaniko container builder if it is not required, and use an alternative builder that does not consume spec.build.tempDir through a shell command.
Tighten Kubernetes RBAC for the Dashboard service account by replacing wildcard verbs on Secrets, Pods, Jobs, and Deployments with the minimum set required.
Remove function-create permission from users and API tokens that do not need it, and require review for build specification changes.

bash

# Upgrade Nuclio to the patched release
helm repo update
helm upgrade nuclio nuclio/nuclio --version 1.17.2 -n nuclio

# Verify the deployed Dashboard version
kubectl -n nuclio get deploy nuclio-dashboard -o jsonpath='{.spec.template.spec.containers[0].image}'