Nuclei CVE-2026-76802

Exploitation requires that the operator (a) launch Nuclei with the -dast flag enabled (CLI DAST scan or an SDK integration that enables DAST), and (b) load an attacker-supplied, unsigned multiprotocol template that contains BOTH an http fuzzing: block AND a code: block - this specific pairing is what routed template loading through the vulnerable DAST branch that omitted the unsigned code-template signature check. No -code flag and no valid cryptographic signature are needed, which is the core of the bypass. Limiting factors: the attack is local/config-driven (AV:L) and needs operator action (UI:R) to run a scan against a malicious template, so it does not affect operators who scan only with trusted/signed first-party templates or who do not use DAST mode; unaffected in 3.10.0 and later.

This is a genuine remote-code-execution flaw (arbitrary shell commands, CWE-78) whose real-world risk is meaningfully constrained by its exploitation model, which is why the vendor CVSS of 4.7 is Medium rather than Critical. The vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N encodes the key limiters: AV:L and UI:R because the attack requires a Nuclei operator to actively run a DAST scan and feed it an attacker-supplied template; AC:H because two conditions must coincide (the -dast flag enabled AND a template pairing a fuzzing: block with an unsigned code: block). No EPSS score, no CISA KEV entry, and no public POC are present in the input, so exploitation status is: no public exploit identified at time of analysis - though the PR#7472 test case (dast-unsigned.yaml) is effectively a working reproducer of the bypass. One notable tension: the vendor scored impact as C:N/I:H/A:N, but the described capability is arbitrary shell command execution on the scanner host, which realistically implies full confidentiality and availability impact too - the score appears conservative and the true technical impact is closer to complete host compromise. This is a real priority for anyone running Nuclei DAST against untrusted or third-party templates, but a low priority for operators who only run signed/first-party templates without -dast.

A CI pipeline or security team runs a Nuclei DAST scan (-dast) using a multiprotocol template pulled from an untrusted or community source. The template embeds a normal fuzzing: block alongside an unsigned code: block, and because the DAST loading branch skipped the code-signing check, the code block executes arbitrary shell commands on the scanning host despite no -code flag and no valid signature. No public exploit is identified, but the fix PR ships a template (dast-unsigned.yaml) that demonstrates the exact bypass.