Vulnerability · Published Sep 2, 2026 · Assigned by GitHub_M

CVE-2026-52831Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

High 8.0

In plain English

A high-severity OS command injection in nuclio from nuclio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.5%top 54.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, <command>). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This issue has been patched in version 1.16.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/nuclio/nuclio	0.0.0-20260601075854-3356b86a8bfa	GHSA-v5px-423j-pf7p
Go	github.com/nuclio/nuclio	0.0.0-20260601075854-3356b86a8bfa	GO-2026-5946

Affected products (as reported)

Vendor	Product	Versions
nuclio	nuclio	< 1.16.4

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/nuclio/nuclio/security/advisories/GHSA-v5px-423j-pf7p x_refsource_CONFIRM
https://github.com/nuclio/nuclio/commit/3356b86a8bfab3f960aa420310ebff765df9dede x_refsource_MISC
https://github.com/nuclio/nuclio/releases/tag/1.16.4 x_refsource_MISC