PT-2026-60683 · Nuclio · Nuclio
CVE-2026-52832
·
Published
2026-07-16
·
Updated
2026-07-17
CVSS v3.1
4.9
Medium
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Nuclio versions prior to 1.16.5
Description
An unauthenticated path traversal issue exists in the Nuclio Dashboard when operating in NOP authentication mode. The
POST /api/functions endpoint does not properly validate the spec.handler field, which is processed by the ParseHandler() function. Because the writeFunctionSourceCodeToTempFile() function uses path.Join without verifying that the resulting path remains within the intended temporary directory, an attacker can use ../ sequences to escape the directory.This allows an unauthenticated attacker to write arbitrary content (provided via the base64-encoded
spec.build.functionSourceCode variable) to any location on the filesystem accessible by the Dashboard process. Since the process runs as root (uid=0), critical directories such as /etc, /tmp, and /usr/local/bin can be targeted. This could lead to full container compromise and potential privilege escalation within the Kubernetes cluster by accessing the service account token.Recommendations
Update to version 1.16.5 or later.
As a temporary workaround, set the
NUCLIO AUTH KIND environment variable to a non-NOP value to enable authentication.
Restrict network access to the Dashboard port (default 8070) to trusted networks only.
Configure the Dashboard container to run as a non-root user.Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nuclio