CVE-2026-52832
Summary
Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion.
During function build, writeFunctionSourceCodeToTempFile() passes the module name directly to path.Join(tempDir, moduleFileName). Go's path.Join internally calls path.Clean, which resolves ../ sequences and allows the resolved path to escape tempDir. The function then calls os.WriteFile at the attacker-controlled path with attacker-controlled content (base64-decoded spec.build.functionSourceCode).
The write executes in the Dashboard container process running as uid=0 (root), allowing writes to any filesystem location the process can access: /tmp, /etc, /usr/local/bin, /etc/cron.d, and more.
- CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N — 7.5 (High)
- CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
- Affected versions: Nuclio <= 1.15.27 (latest at time of research, dynamically verified)
Details
Root Cause
The vulnerability spans three functions. The path from user input to disk write is:
1. ParseHandler — no path validation (pkg/functionconfig/handler.go:25-38):
// pkg/functionconfig/handler.go:25-38
func ParseHandler(handler string) (string, string, error) {
moduleAndEntrypoint := strings.Split(handler, ":")
switch len(moduleAndEntrypoint) {
case 1:
return "", moduleAndEntrypoint[0], nil
case 2:
// Returns moduleFileName verbatim — no path sanitization
return moduleAndEntrypoint[0], moduleAndEntrypoint[1], nil
default:
return "", "", errors.Errorf("Invalid handler name %s", handler)
}
}
Input "../../../../tmp/vul007_proof.txt:handler" returns moduleFileName = "../../../../tmp/vul007_proof.txt".
2. writeFunctionSourceCodeToTempFile — unsafe path construction (pkg/processor/build/builder.go:613-661):
// builder.go:624-657 (abridged)
tempDir, err :=
⚡ Watch CVE-2026-52832
Get an email if CVE-2026-52832 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-52832)