{"id":"CVE-2026-52831","title":"Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing","summary":"Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container…","severity":"high","cvss":8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"nuclio","product":"github.com/nuclio/nuclio","affected":["github.com/nuclio/nuclio < 0.0.0-20260601075854-3356b86a8bfa"],"patched":["github.com/nuclio/nuclio 0.0.0-20260601075854-3356b86a8bfa"],"published":"2026-09-02","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:04:42.813","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52831","references":[{"url":"https://github.com/nuclio/nuclio/commit/3356b86a8bfab3f960aa420310ebff765df9dede","label":"security-advisories@github.com"},{"url":"https://github.com/nuclio/nuclio/releases/tag/1.16.4","label":"security-advisories@github.com"},{"url":"https://github.com/nuclio/nuclio/security/advisories/GHSA-v5px-423j-pf7p","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-v5px-423j-pf7p"}],"tags":["nvd","ghsa","go","score-dispute"],"epss":0.00319,"epssPercentile":0.24994,"aliases":["GHSA-v5px-423j-pf7p"],"ecosystem":"go","scores":{"nvd":8,"ghsa":10},"ingestedAt":"2026-07-08T20:46:41.630Z","slug":"CVE-2026-52831","body":"## Overview\n\nNuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, <command>). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This issue has been patched in version 1.16.4.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-52831)\n\nAffected packages:\n\n- `github.com/nuclio/nuclio < 0.0.0-20260601075854-3356b86a8bfa`\n\nPatched in:\n\n- `github.com/nuclio/nuclio 0.0.0-20260601075854-3356b86a8bfa`\n\nSource: https://github.com/advisories/GHSA-v5px-423j-pf7p","depth":"twilight","depthScore":44,"depthScoreParts":{"impact":44,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201745,"id":"CVE-2026-52831","ts":1789399665060,"field":"cvss","old":"10","new":"8"},{"seq":201744,"id":"CVE-2026-52831","ts":1789399665060,"field":"severity","old":"critical","new":"high"},{"seq":200475,"id":"CVE-2026-52831","ts":1789397302448,"field":"cvss","old":"8","new":"10"},{"seq":200474,"id":"CVE-2026-52831","ts":1789397302448,"field":"severity","old":"high","new":"critical"},{"seq":198392,"id":"CVE-2026-52831","ts":1789391894395,"field":"cvss","old":"10","new":"8"},{"seq":198391,"id":"CVE-2026-52831","ts":1789391894395,"field":"severity","old":"critical","new":"high"},{"seq":196188,"id":"CVE-2026-52831","ts":1789383532848,"field":"cvss","old":"8","new":"10"},{"seq":196187,"id":"CVE-2026-52831","ts":1789383532848,"field":"severity","old":"high","new":"critical"},{"seq":195117,"id":"CVE-2026-52831","ts":1789380416264,"field":"cvss","old":"10","new":"8"},{"seq":195116,"id":"CVE-2026-52831","ts":1789380416264,"field":"severity","old":"critical","new":"high"},{"seq":193904,"id":"CVE-2026-52831","ts":1789378412851,"field":"cvss","old":"8","new":"10"},{"seq":193903,"id":"CVE-2026-52831","ts":1789378412851,"field":"severity","old":"high","new":"critical"},{"seq":192691,"id":"CVE-2026-52831","ts":1789376366182,"field":"cvss","old":"10","new":"8"},{"seq":192690,"id":"CVE-2026-52831","ts":1789376366182,"field":"severity","old":"critical","new":"high"},{"seq":191478,"id":"CVE-2026-52831","ts":1789373318826,"field":"cvss","old":"8","new":"10"},{"seq":191477,"id":"CVE-2026-52831","ts":1789373318826,"field":"severity","old":"high","new":"critical"},{"seq":190263,"id":"CVE-2026-52831","ts":1789369252405,"field":"cvss","old":"10","new":"8"},{"seq":190262,"id":"CVE-2026-52831","ts":1789369252405,"field":"severity","old":"critical","new":"high"},{"seq":189050,"id":"CVE-2026-52831","ts":1789368197324,"field":"cvss","old":"8","new":"10"},{"seq":189049,"id":"CVE-2026-52831","ts":1789368197324,"field":"severity","old":"high","new":"critical"},{"seq":187833,"id":"CVE-2026-52831","ts":1789365110560,"field":"cvss","old":"10","new":"8"},{"seq":187832,"id":"CVE-2026-52831","ts":1789365110560,"field":"severity","old":"critical","new":"high"},{"seq":186620,"id":"CVE-2026-52831","ts":1789363186673,"field":"cvss","old":"8","new":"10"},{"seq":186619,"id":"CVE-2026-52831","ts":1789363186673,"field":"severity","old":"high","new":"critical"},{"seq":185406,"id":"CVE-2026-52831","ts":1789361059309,"field":"cvss","old":"10","new":"8"},{"seq":185405,"id":"CVE-2026-52831","ts":1789361059309,"field":"severity","old":"critical","new":"high"},{"seq":184193,"id":"CVE-2026-52831","ts":1789358069368,"field":"cvss","old":"8","new":"10"},{"seq":184192,"id":"CVE-2026-52831","ts":1789358069368,"field":"severity","old":"high","new":"critical"},{"seq":182444,"id":"CVE-2026-52831","ts":1789354188727,"field":"cvss","old":"10","new":"8"},{"seq":182443,"id":"CVE-2026-52831","ts":1789354188727,"field":"severity","old":"critical","new":"high"},{"seq":181237,"id":"CVE-2026-52831","ts":1789353053059,"field":"cvss","old":"8","new":"10"},{"seq":181236,"id":"CVE-2026-52831","ts":1789353053059,"field":"severity","old":"high","new":"critical"},{"seq":180030,"id":"CVE-2026-52831","ts":1789350129387,"field":"cvss","old":"10","new":"8"},{"seq":180029,"id":"CVE-2026-52831","ts":1789350129387,"field":"severity","old":"critical","new":"high"},{"seq":178823,"id":"CVE-2026-52831","ts":1789348015750,"field":"cvss","old":"8","new":"10"},{"seq":178822,"id":"CVE-2026-52831","ts":1789348015750,"field":"severity","old":"high","new":"critical"},{"seq":177616,"id":"CVE-2026-52831","ts":1789346249055,"field":"cvss","old":"10","new":"8"},{"seq":177615,"id":"CVE-2026-52831","ts":1789346249055,"field":"severity","old":"critical","new":"high"},{"seq":176409,"id":"CVE-2026-52831","ts":1789342940195,"field":"cvss","old":"8","new":"10"},{"seq":176408,"id":"CVE-2026-52831","ts":1789342940195,"field":"severity","old":"high","new":"critical"},{"seq":176070,"id":"CVE-2026-52831","ts":1789342384934,"field":"cvss","old":"10","new":"8"},{"seq":176069,"id":"CVE-2026-52831","ts":1789342384934,"field":"severity","old":"critical","new":"high"},{"seq":175731,"id":"CVE-2026-52831","ts":1789338552178,"field":"cvss","old":"8","new":"10"},{"seq":175730,"id":"CVE-2026-52831","ts":1789338552178,"field":"severity","old":"high","new":"critical"},{"seq":174526,"id":"CVE-2026-52831","ts":1789334727705,"field":"cvss","old":"10","new":"8"},{"seq":174525,"id":"CVE-2026-52831","ts":1789334727705,"field":"severity","old":"critical","new":"high"},{"seq":173321,"id":"CVE-2026-52831","ts":1789333432793,"field":"cvss","old":"8","new":"10"},{"seq":173320,"id":"CVE-2026-52831","ts":1789333432793,"field":"severity","old":"high","new":"critical"},{"seq":172135,"id":"CVE-2026-52831","ts":1789330967567,"field":"cvss","old":"10","new":"8"},{"seq":172134,"id":"CVE-2026-52831","ts":1789330967567,"field":"severity","old":"critical","new":"high"}]}