CVE-2026-79755

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=<value>" command that is executed via the host shell (/bin/sh -c). Because the default auth kind is nop (unauthenticated), a remote attacker can inject arbitrary OS commands that run as root inside the dashboard container, which holds the Docker socket → host compromise. This issue has been patched in version 1.17.4.

• CWE-78

• https://github.com/nuclio/nuclio/commit/24582ac354d04951ec6786b3fe6ccf3b32652e9f
• https://github.com/nuclio/nuclio/pull/4220
• https://github.com/nuclio/nuclio/releases/tag/1.17.4
• https://github.com/nuclio/nuclio/security/advisories/GHSA-2893-rq73-w22x
• https://github.com/nuclio/nuclio/security/advisories/GHSA-2893-rq73-w22x

Published

Sep 2, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79748MCPHub is a unified hub for centrally managing and dynamical…9.9
• CVE-2026-79749MCPHub is a unified hub for centrally managing and dynamical…7.6
• CVE-2026-7975Use after free in DevTools in Google Chrome prior to 148.0.7…8.3
• CVE-2026-79750MCPHub is a unified hub for centrally managing and dynamical…7.7
• CVE-2026-79752CakePHP is a rapid development framework for PHP. Prior to 4…9.2
• CVE-2026-79754Nuclio is a "Serverless" framework for Real-Time Events and …7.1
• CVE-2026-79756Nuclio is a "Serverless" framework for Real-Time Events and …8.7
• CVE-2026-7976Use after free in Views in Google Chrome prior to 148.0.7778…7.5
• CVE-2026-79767Gardener implements the automated management and operation o…5.5
• CVE-2026-79769Nokogiri versions before 1.19.4 contain a possible invalid (…5.5
• CVE-2026-7977Inappropriate implementation in Canvas in Google Chrome prio…6.3
• CVE-2026-79770Nokogiri versions before 1.19.3 contain regular expression d…7.5