Nuclio vulnerabilities
We track 7 vulnerabilities in Nuclio products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 2, 2026.
Latest Nuclio vulnerabilities
- 8.7 High severity
nuclio: Improper Neutralization of Special Elements used in an OS Command
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for fu
- 8.0 High severity
nuclio: Improper Neutralization of Special Elements used in an OS Command
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=<va
- 7.1 High severity
nuclio: Improper Neutralization of Special Elements used in a Command
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the K
- 8.0 High severity
nuclio: Improper Control of Generation of Code
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositori
- 8.0 High severity
nuclio: Improper Neutralization of Special Elements used in an OS Command
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, <command
- 8.3 High severity
nuclio: Missing Authorization
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass OP
- 9.8 Critical severity
nuclio: Failure to Sanitize Special Elements into a Different Plane
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTT