CVE-2026-79754: Nuclio: Kaniko build tempDir command injection

Deferred

Published 02-09-2026Last modified 02-09-2026

Vulnerability summary

CVE-2026-79754 is a high (CVSS 7.1) vulnerability in nuclio. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 53.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.1/10

010

High · v4.0 (CVE.org)

EPSS score

0.71%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

02-09-2026
PublishedVulnerability first disclosed.
02-09-2026
Last modifiedVulnerability information updated.

Description

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permission can inject shell metacharacters into this field and achieve arbitrary command execution inside the Dashboard container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace. This issue has been patched in version 1.17.2.

CVSS metrics

2 scores · 2 sources · 1 version

v4.07.1

EPSS trend

Probability

0.71%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.71% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-77Improper Neutralization of Special Elements used in a CommandThe product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Nuclio1 product

nuclio≥ 1.6.19, < 1.17.2

1 vendor · 1 product

References

4 links

github.com/nuclio/nuclio/security/advisories/GHSA-x44h-qmrv-mh72X Refsource CONFIRM
github.com/nuclio/nuclio/pull/4190X Refsource MISC
github.com/nuclio/nuclio/commit/e3ed7de65c20c270a2035b7c27b25800e5b1e252X Refsource MISC
github.com/nuclio/nuclio/releases/tag/1.17.2X Refsource MISC