CVE-2026-79755: Nuclio Serverless Framework RCE Vulnerability

CVE-2026-79755 Overview

CVE-2026-79755 is an OS command injection vulnerability [CWE-78] in Nuclio, an open-source serverless framework for real-time events and data processing. On the Nuclio local Docker platform, the function namespace value is interpolated unvalidated into a docker ps --filter "label=nuclio.io/namespace=<value>" command executed via /bin/sh -c. Because the default authentication mode is nop (unauthenticated), a remote attacker can inject arbitrary shell commands. The injected commands execute as root inside the dashboard container, which holds a mounted Docker socket, leading to host compromise. The issue is fixed in Nuclio version 1.17.4.

Critical Impact
Remote unauthenticated attackers can inject OS commands that run as root in the dashboard container, pivot through the mounted Docker socket, and achieve full host compromise.

Affected Products

Nuclio serverless framework versions prior to 1.17.4
Nuclio deployments using the local Docker platform (pkg/dockerclient/shell.go)
Nuclio dashboards running with the default nop authentication kind

Discovery Timeline

2026-09-02 - CVE-2026-79755 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-79755

Vulnerability Analysis

The vulnerability resides in Nuclio's Docker client shell wrapper. When listing containers, Nuclio constructs a docker ps command by concatenating filter arguments into a single string, then executes the result through the host shell interpreter /bin/sh -c.

The function namespace supplied through the dashboard API flows into the label filter without sanitization or shell escaping. An attacker who can reach the Nuclio dashboard can submit a crafted namespace containing shell metacharacters such as ", `, $(), or ;, breaking out of the double-quoted argument and executing arbitrary commands. Because Nuclio ships with auth.kind=nop by default, no credentials are required to reach the vulnerable code path.

Root Cause

The root cause is unsafe command construction using fmt.Sprintf with double-quoted shell arguments. User-controlled namespace values were embedded directly into the shell command string, treating shell quoting as sufficient protection. This is a textbook instance of [CWE-78] Improper Neutralization of Special Elements Used in an OS Command.

Attack Vector

The attack is network-reachable through the Nuclio dashboard API. An attacker submits a function creation or listing request specifying a namespace payload such as foo";id;#. The value flows into the docker ps --filter "label=nuclio.io/namespace=foo";id;#" command and is executed by /bin/sh -c. The injected commands run as root inside the dashboard container, which mounts the Docker socket. From that position, an attacker can launch privileged containers, mount the host filesystem, and take over the underlying host.

// Patch in pkg/dockerclient/shell.go — shell-escape filter tokens
// filter values are interpolated into a command run via /bin/sh -c, so shell-quote each
// filter token as a single arg — label values in particular carry unvalidated namespaces
nameFilterArgument := ""
if options.Name != "" {
    nameFilterArgument = fmt.Sprintf("--filter %s ", common.Quote(fmt.Sprintf("name=^/%s$", options.Name)))
}

idFilterArgument := ""
if options.ID != "" {
    idFilterArgument = fmt.Sprintf("--filter %s", common.Quote(fmt.Sprintf("id=%s", options.ID)))
}

labelFilterArgument := ""
for labelName, labelValue := range options.Labels {
    labelFilterArgument += fmt.Sprintf("--filter %s ",
        common.Quote(fmt.Sprintf("label=%s=%s", labelName, labelValue)))
}

Source: Nuclio GitHub Commit 24582ac

Detection Methods for CVE-2026-79755

Indicators of Compromise

Unexpected child processes of the Nuclio dashboard container spawned by /bin/sh -c, especially processes unrelated to docker (for example curl, wget, nc, bash, python).
Namespace, label, or filter fields in Nuclio API requests containing shell metacharacters such as ", `, $(, ;, |, or &&.
New containers created on the Docker host with unusual images, host filesystem mounts (/:/host), or --privileged flags shortly after dashboard API activity.
Outbound network connections from the dashboard container to previously unseen IP addresses or command-and-control infrastructure.

Detection Strategies

Inspect Nuclio dashboard access logs for POST/GET requests where namespace or label parameters include shell metacharacters or URL-encoded equivalents (%22, %3B, %60).
Monitor process telemetry on Nuclio hosts for dockerd invocations initiated by shell interpreters within the dashboard container.
Audit Docker API activity for container create or run events originating from the Nuclio dashboard that use host mounts or privileged flags.

Monitoring Recommendations

Enable container runtime auditing and forward events to a centralized SIEM or data lake for correlation with Nuclio API traffic.
Alert on any Nuclio deployment where platform.kind=local is combined with auth.kind=nop and the dashboard is reachable outside the trusted management network.
Track Nuclio version banners across the fleet and flag any instance below 1.17.4.

How to Mitigate CVE-2026-79755

Immediate Actions Required

Upgrade Nuclio to version 1.17.4 or later, which shell-escapes all filter tokens using common.Quote before passing them to the host shell.
Restrict network exposure of the Nuclio dashboard to trusted administrative networks and place it behind authenticated reverse proxies.
Change the default authentication mode from nop to an authenticated provider so anonymous callers cannot reach the vulnerable API.
Review Docker and host logs for signs of prior exploitation, particularly unexpected containers, image pulls, or shell activity.

Patch Information

The fix is contained in Nuclio release v1.17.4, delivered through pull request #4220 and commit 24582ac. See the GitHub Security Advisory GHSA-2893-rq73-w22x for full advisory content.

Workarounds

If immediate upgrade is not possible, block external access to the dashboard port and permit only management jump hosts through firewall rules.
Deploy Nuclio without mounting the Docker socket into the dashboard container to reduce blast radius if injection succeeds.
Run the dashboard container under a non-root user and drop unneeded Linux capabilities to limit post-exploitation impact.

bash

# Configuration example — enforce authentication and restrict dashboard exposure
# 1. Upgrade to the patched release
docker pull quay.io/nuclio/dashboard:1.17.4-amd64

# 2. Run the dashboard with an authenticated mode and bind only to localhost
docker run -d --name nuclio-dashboard \
  -p 127.0.0.1:8070:8070 \
  -e NUCLIO_AUTH_KIND=iguazio \
  -v /var/run/docker.sock:/var/run/docker.sock \
  quay.io/nuclio/dashboard:1.17.4-amd64

# 3. Front the dashboard with a reverse proxy that enforces authentication
# and terminates TLS before traffic reaches the container.