CVE-2026-52832 Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...

CVE-2026-52832

Nuclio (a serverless framework for real-time event/data processing) is affected by an unauthenticated path traversal in the Dashboard's POST /api/functions endpoint. In the default NOP auth mode, the spec.handler field is parsed by functionconfig.ParseHandler() which splits on : without path vali...

CVE-2026-52832-PoC-exploit-nuclio-dashboard

CVE-2026-52832-PoC-exploit-nuclio-dashboard Nuclio Dashboard NOP 모드는 인증되지 않은 POST /api/functions 요청을 수락합니다. spec.handler 필드는 경로 검증이 이루어지지 않으므로 ../../../../tmp/x.txt:handler 같은 값이 path.Join을 통해 빌드 임시 디렉터리를 벗어나며, 공격자가 root 권한으로 임의의 경로에 임의의 내용을 작성할 수 있게 됩니다. CVE-2026-52832, ≤1.15.27 CVE-2026-52832...