CVE-2026-52831: Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-02 · updated 2026-09-09
Weakness: CWE-78

Description

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, <command>). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This issue has been patched in version 1.16.4.

Affected products

nuclio: before 1.16.4

References

https://github.com/nuclio/nuclio/commit/3356b86a8bfab3f960aa420310ebff765df9dede
https://github.com/nuclio/nuclio/releases/tag/1.16.4
https://github.com/nuclio/nuclio/security/advisories/GHSA-v5px-423j-pf7p

Get alerted when CVE-2026-52831 or the next vulnerability affects your stack