CVE-2026-79755: Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)

Vulnerability summary

CVE-2026-79755 is a high (CVSS 8.0) vulnerability in nuclio. EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51.8% of scored vulnerabilities.

Timeline

1. 02-09-2026
   PublishedVulnerability first disclosed.
2. 04-09-2026
   Last modifiedVulnerability information updated.

Description

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=<value>" command that is executed via the host shell (/bin/sh -c). Because the default auth kind is nop (unauthenticated), a remote attacker can inject arbitrary OS commands that run as root inside the dashboard container, which holds the Docker socket → host compromise. This issue has been patched in version 1.17.4.

• CWE-78Improper Neutralization of Special Elements used in an OS CommandThe product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.