PT-2026-60684 · Nuclio · Nuclio
CVE-2026-52833
·
Published
2026-07-16
·
Updated
2026-07-30
CVSS v3.1
8.0
High
| Vector | AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Nuclio versions prior to 1.16.5
Description
Nuclio's Java runtime is susceptible to code injection during the function build process. The issue occurs because the
createGradleBuildScript() function uses the Go text/template package to generate a build.gradle file, rendering values from runtimeAttributes.repositories[] without proper escaping. An attacker can provide a specially crafted string containing a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements. These statements are executed unconditionally as root during the Gradle configuration phase within the build container.Since the Dashboard API uses NOP authentication by default, an unauthenticated attacker can trigger this by sending a malicious function definition. This allows for remote code execution (RCE) inside the builder container, enabling the attacker to read sensitive files, access network endpoints, or tamper with the compiled function artifact. In certain environments, this could lead to the theft of cloud instance metadata (SSRF), Kubernetes ServiceAccount tokens, or registry credentials.
Recommendations
Update to version 1.16.5 or later.
As a temporary mitigation, enable authentication on the Dashboard by setting
NUCLIO AUTH KIND to a non-NOP authenticator.
Restrict network access to the Dashboard port (8070) to trusted internal networks only.
Disable Java runtime support if it is not required.
Use the kaniko builder instead of the docker builder to reduce the potential impact of a container escape.Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nuclio