CVE-2026-79754

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permission can inject shell metacharacters into this field and achieve arbitrary command execution inside the Dashboard container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace. This issue has been patched in version 1.17.2.

• CWE-77

• https://github.com/nuclio/nuclio/commit/e3ed7de65c20c270a2035b7c27b25800e5b1e252
• https://github.com/nuclio/nuclio/pull/4190
• https://github.com/nuclio/nuclio/releases/tag/1.17.2
• https://github.com/nuclio/nuclio/security/advisories/GHSA-x44h-qmrv-mh72
• https://github.com/nuclio/nuclio/security/advisories/GHSA-x44h-qmrv-mh72

Published

Sep 2, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79747MCPHub is a unified hub for centrally managing and dynamical…7.1
• CVE-2026-79748MCPHub is a unified hub for centrally managing and dynamical…9.9
• CVE-2026-79749MCPHub is a unified hub for centrally managing and dynamical…7.6
• CVE-2026-7975Use after free in DevTools in Google Chrome prior to 148.0.7…8.3
• CVE-2026-79750MCPHub is a unified hub for centrally managing and dynamical…7.7
• CVE-2026-79752CakePHP is a rapid development framework for PHP. Prior to 4…9.2
• CVE-2026-79755Nuclio is a "Serverless" framework for Real-Time Events and …8
• CVE-2026-79756Nuclio is a "Serverless" framework for Real-Time Events and …8.7
• CVE-2026-7976Use after free in Views in Google Chrome prior to 148.0.7778…7.5
• CVE-2026-79767Gardener implements the automated management and operation o…5.5
• CVE-2026-79769Nokogiri versions before 1.19.4 contain a possible invalid (…5.5
• CVE-2026-7977Inappropriate implementation in Canvas in Google Chrome prio…6.3