CVE-2026-29042
Published: 06 March 2026
Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime…
more
reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20.
Mitigating Controls (NIST 800-53 r5)AI
Directly validates and sanitizes the user-supplied X-Nuclio-Arguments HTTP header before incorporating it into shell commands, preventing command injection exploitation.
Remediates the command injection flaw by applying security patches such as the upgrade to Nuclio version 1.15.20.
Enforces restrictions on the format, length, and content of X-Nuclio-Arguments header inputs to limit opportunities for shell command injection.
Security SummaryAI
CVE-2026-29042 is a command injection vulnerability (CWE-75) in the Nuclio Shell Runtime component of Nuclio, an open-source serverless framework for real-time events and data processing. Affecting versions prior to 1.15.20, the flaw arises when a function is invoked via HTTP, as the runtime reads the user-supplied value from the X-Nuclio-Arguments header and incorporates it directly into shell commands without validation or sanitization. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
The vulnerability can be exploited remotely by unauthenticated attackers with network access, requiring low complexity and no privileges or user interaction. By crafting a malicious X-Nuclio-Arguments header in an HTTP request to invoke a Nuclio function, an attacker can inject arbitrary shell commands, potentially achieving remote code execution. This grants high-impact access to confidentiality, integrity, and availability, allowing full system compromise on the hosting environment.
Mitigation is available via upgrading to Nuclio version 1.15.20, where the issue was patched. Relevant advisories and resources include the GitHub security advisory (GHSA-95fj-3w7g-4r27), the patching commit (5352d7e16cf92f4350a2f8d806c4b80b626b5c5a), pull request 4030, and the release notes for version 1.15.20.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated remote exploitation of a public-facing HTTP endpoint in Nuclio (T1190) to inject and execute arbitrary Unix shell commands (T1059.004), achieving RCE.