Description

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated—unvalidated—into a double-quoted docker ps --filter "label=nuclio.io/namespace=<value>" command that is executed via the host shell (/bin/sh -c). Because the default auth kind is nop (unauthenticated), a remote attacker can inject arbitrary OS commands that run as root inside the dashboard container, which holds the Docker socket → host compromise. This issue has been patched in version 1.17.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-02T17:17:59.940Z",
  "pubdate": "2026-09-02T17:17:59.940Z",
  "executiveSummary": "Nuclio versions prior to 1.17.4 are susceptible to a critical OS command injection vulnerability within the dashboard component of the Nuclio local Docker platform.\nThe vulnerability arises from improper input validation when processing function namespaces, allowing an unauthenticated remote attacker to inject arbitrary shell commands.\nSince the affected dashboard container possesses access to the Docker socket, successful exploitation leads to full compromise of the underlying host system with root-level privileges.\nThe risk is exacerbated by the default 'nop' (unauthenticated) authentication configuration, enabling remote execution without valid credentials.\nThis flaw represents a complete breakdown of isolation between the Nuclio dashboard container and the host environment.",
  "technicalDetails": "The root cause of this vulnerability is an unsanitized interpolation of user-supplied input into a system shell command execution flow. Specifically, the Nuclio dashboard platform takes the 'function namespace' variable and directly embeds it into a command string intended for the Docker CLI. The command follows the structure: docker ps --filter \"label=nuclio.io/namespace=<value>\".\nThis command is executed via the host shell (/bin/sh -c). Because the namespace input is not validated or properly escaped, an attacker can supply malicious payloads utilizing shell metacharacters (such as backticks, semicolons, or pipe operators) to break out of the intended argument string. For example, a crafted namespace string containing command separators allows for the injection of arbitrary OS commands that execute within the context of the dashboard container process.\nThe exploitation flow begins with a remote attacker sending a crafted HTTP request to the Nuclio dashboard, where the malicious namespace value is passed to the vulnerable backend logic. Because the dashboard operates with the Docker socket mounted, the injected commands gain the ability to interact with the Docker daemon. A typical post-exploitation payload involves the attacker issuing docker commands to create a new, privileged container that mounts the host root filesystem, effectively granting the attacker full control over the host operating system.\nThe vulnerability is present in versions of Nuclio prior to 1.17.4. It is particularly severe due to the 'nop' authentication mode being the default, which removes any barrier to entry for an attacker with network reach to the dashboard. The combination of unauthenticated access, command execution, and Docker socket exposure constitutes a critical security failure, allowing for complete host system takeover."
}