Description

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-02T17:17:40.847Z",
  "pubdate": "2026-09-02T17:17:40.847Z",
  "executiveSummary": "Nuclio versions prior to 1.16.0 contain a critical Broken Access Control vulnerability within the project management API.\nThe vulnerability allows authenticated users to bypass Open Policy Agent (OPA) authorization checks on write-sensitive API endpoints, specifically PUT /api/projects/{id} and DELETE /api/projects.\nThis flaw grants unauthorized actors the ability to modify or delete arbitrary projects, including all associated resources such as functions and API gateways, regardless of their project membership status.\nThe risk is severe as it enables unauthorized data destruction and potential service disruption within the Nuclio environment.\nExploitation requires the attacker to possess a valid authenticated session, although no specific project-level administrative privileges are necessary.\nThe vulnerability highlights a failure in the middleware or request processing logic responsible for enforcing OPA-based authorization policies on restricted administrative operations.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure implementation of the authorization flow within the Nuclio Dashboard API, specifically concerning how it interfaces with the Open Policy Agent (OPA) for authorization decisions on write-intensive operations.\nThe vulnerable component is the Nuclio Dashboard API, which manages project resources. The logic fails to strictly enforce authorization checks for the PUT and DELETE methods associated with project management endpoints.\nUnder normal operating conditions, OPA is designed to evaluate whether the authenticated user context (e.g., project membership or role-based access control) is sufficient to perform a requested action on a target resource.\nIn the affected versions (prior to 1.16.0), the application fails to correctly validate the user's authorization status for these specific paths. Consequently, the API allows the requests to proceed to the backend storage or resource manager without rejecting them via the policy enforcement point (PEP).\nAn attack flow typically begins with an authenticated user identifying a valid target project ID. The attacker then crafts a malicious request—either a PUT request to update project configurations or a DELETE request to remove the project entirely.\nBecause the authorization check is bypassed, the Nuclio Dashboard proceeds to execute the requested operation. This results in the modification or deletion of the target project and all secondary objects linked to it, such as serverless functions, API gateways, and configuration settings.\nSince the check is omitted at the API layer, the system treats the request as legitimate, effectively disregarding the intended multi-tenant or project-isolated security boundaries.\nThis vulnerability is restricted to authenticated sessions, meaning an attacker must first obtain legitimate access to the dashboard. Once authenticated, the lack of granular permission enforcement allows for vertical and horizontal privilege escalation regarding resource management.\nThe post-exploitation impact includes the permanent loss of project data, denial of service for functions residing within the deleted projects, and potential configuration tampering that could be leveraged for further malicious activities within the infrastructure."
}