Cyber Posture

CVE-2026-29042

CriticalPublic PoC

Published: 06 March 2026

Published
06 March 2026
Modified
10 March 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0027 50.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime…

more

reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly validates and sanitizes the user-supplied X-Nuclio-Arguments HTTP header before incorporating it into shell commands, preventing command injection exploitation.

prevent

Remediates the command injection flaw by applying security patches such as the upgrade to Nuclio version 1.15.20.

prevent

Enforces restrictions on the format, length, and content of X-Nuclio-Arguments header inputs to limit opportunities for shell command injection.

Security SummaryAI

CVE-2026-29042 is a command injection vulnerability (CWE-75) in the Nuclio Shell Runtime component of Nuclio, an open-source serverless framework for real-time events and data processing. Affecting versions prior to 1.15.20, the flaw arises when a function is invoked via HTTP, as the runtime reads the user-supplied value from the X-Nuclio-Arguments header and incorporates it directly into shell commands without validation or sanitization. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.

The vulnerability can be exploited remotely by unauthenticated attackers with network access, requiring low complexity and no privileges or user interaction. By crafting a malicious X-Nuclio-Arguments header in an HTTP request to invoke a Nuclio function, an attacker can inject arbitrary shell commands, potentially achieving remote code execution. This grants high-impact access to confidentiality, integrity, and availability, allowing full system compromise on the hosting environment.

Mitigation is available via upgrading to Nuclio version 1.15.20, where the issue was patched. Relevant advisories and resources include the GitHub security advisory (GHSA-95fj-3w7g-4r27), the patching commit (5352d7e16cf92f4350a2f8d806c4b80b626b5c5a), pull request 4030, and the release notes for version 1.15.20.

Details

CWE(s)

Affected Products

iguazio
nuclio
≤ 1.15.20

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

The vulnerability enables unauthenticated remote exploitation of a public-facing HTTP endpoint in Nuclio (T1190) to inject and execute arbitrary Unix shell commands (T1059.004), achieving RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References