CVE-2026-79754: Nuclio: Kaniko build tempDir command injection
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permission can inject shell metacharacters into this field and achieve arbitrary command execution inside the Dashboard container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace. This issue has been patched in version 1.17.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nuclio Dashboardto a version that resolves this vulnerability.Fixed in 1.17.2 - Compensating control
If feasible, disable/avoid enabling the Kaniko container builder in the Nuclio Dashboard build pipeline to prevent command injection via the spec.build.tempDir field until upgraded to 1.17.2.
Event History
Frequently Asked Questions
Who can exploit this issue?
A user must have permission to create functions through the Nuclio Dashboard and must be able to supply a value for spec.build.tempDir. Exploitation also requires the Kaniko container builder to be enabled.
Are default deployments affected?
The provided information only identifies deployments where the Kaniko container builder is enabled as affected. It does not state whether Kaniko is enabled by default.
What is the impact after successful exploitation?
An attacker can execute arbitrary commands inside the Dashboard container. That container uses a Kubernetes service account with wildcard access to Secrets, Pods, Jobs, and Deployments in its namespace.
What versions need remediation?
Nuclio versions from 1.6.19 up to, but not including, 1.17.2 are affected. Upgrade to version 1.17.2, which includes the patch.