Nuclio EUVD-2026-70217

Nuclio container orchestration dashboard (versions 1.6.19-1.17.1) contains a vulnerability allowing developers with standard function-create permissions to execute arbitrary code and access cluster secrets, running workloads, and deployment configurations. Organizations face risk of credential theft, sensitive data exposure, and operational disruption if developer accounts are compromised or access controls are not strictly enforced.

Within 24 hours, audit Nuclio RBAC and restrict function-create permissions to administrators only; document all users currently holding these permissions and assess trustworthiness. Within 7 days, reconfigure the Nuclio Dashboard Kubernetes service account to apply least-privilege permissions by explicitly removing wildcard access to Secrets, Pods, Jobs, and Deployments, granting only minimum required permissions; implement Pod Security Policies to block privilege escalation at the container level. Within 30 days, monitor Nuclio project releases for patched versions (no patch currently released) and deploy network policies and container security contexts to further isolate the Dashboard and prevent lateral movement should the vulnerability be exploited.

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce strict RBAC to restrict function-create permissions to essential administrators only; (2) Apply least-privilege Kubernetes service account configuration by explicitly denying wildcard access to Secrets, Pods, Jobs, and Deployments; (3) Implement Pod Security Policies and NetworkPolicies to restrict container runtime privileges and namespace-level lateral movement; (4) Enable Kubernetes audit logging to detect exploitation attempts; (5) Use Kubernetes admission controllers to prevent unauthorized container execution.