CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote() for the named-resource shell command path, but the list-all resource path (triggered when no specific resource name is provided) still interpolates the resourceNamespace parameter unquoted into a /bin/sh -c command string. An unauthenticated attacker can inject shell metacharacters via the X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace HTTP headers to achieve arbitrary command execution inside the dashboard container. This issue has been patched in version 1.17.4.

• CWE-78

• https://github.com/nuclio/nuclio/commit/86d4e39387d8845f567649201798800830f08411
• https://github.com/nuclio/nuclio/pull/4223
• https://github.com/nuclio/nuclio/releases/tag/1.17.4
• https://github.com/nuclio/nuclio/security/advisories/GHSA-mq8w-f7w8-5rgg

Published

Sep 2, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79749MCPHub is a unified hub for centrally managing and dynamical…7.6
• CVE-2026-7975Use after free in DevTools in Google Chrome prior to 148.0.7…8.3
• CVE-2026-79750MCPHub is a unified hub for centrally managing and dynamical…7.7
• CVE-2026-79752CakePHP is a rapid development framework for PHP. Prior to 4…9.2
• CVE-2026-79754Nuclio is a "Serverless" framework for Real-Time Events and …7.1
• CVE-2026-79755Nuclio is a "Serverless" framework for Real-Time Events and …8
• CVE-2026-7976Use after free in Views in Google Chrome prior to 148.0.7778…7.5
• CVE-2026-79767Gardener implements the automated management and operation o…5.5
• CVE-2026-79769Nokogiri versions before 1.19.4 contain a possible invalid (…5.5
• CVE-2026-7977Inappropriate implementation in Canvas in Google Chrome prio…6.3
• CVE-2026-79770Nokogiri versions before 1.19.3 contain regular expression d…7.5
• CVE-2026-79771Nokogiri versions before 1.19.3 contain a memory leak in the…5.3