Command Injection Affecting github.com/nuclio/nuclio/pkg/platform/kube/functionres package, versions <1.16.4
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMNUCLIONUCLIOPKGPLATFORMKUBEFUNCTIONRES-17912237
- published9 Jul 2026
- disclosed8 Jul 2026
- creditUnknown
Introduced: 8 Jul 2026
CVE-2026-52831 Â (opens in a new tab)How to fix?
Upgrade github.com/nuclio/nuclio/pkg/platform/kube/functionres to version 1.16.4 or higher.
Overview
Affected versions of this package are vulnerable to Command Injection via improper handling of user-supplied input in the generateCronTriggerCronJobSpec process. An attacker can execute arbitrary shell commands with root privileges in the CronJob pod by injecting malicious content into event headers or body fields, which are concatenated into a shell command and executed by /bin/sh -c without adequate sanitization. This allows for exfiltration of sensitive data, lateral movement within cloud environments, and persistent access through orphaned CronJobs. This is only exploitable if the attacker has network access to the Dashboard API and can submit function specifications.
Workaround
This vulnerability can be mitigated by restricting network access to the Dashboard API, disabling cron triggers if not required, or removing the batch API group permission from the Nuclio controller ServiceAccount to prevent CronJob creation.