CVE-2026-29042

Nuclio Shell Runtime Command Injection Leading to Privilege Escalation

Published: Mar 6, 2026Updated: Mar 6, 2026 Sources: CVE List NVD GHSACWE-75

N/ACVSS

NVD MITRE

Description

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20.

No summary for this CVE yet.

Weaknesses

CWE-75

Affected Products

nuclio

oss-project

nuclioOn-prem

Cloud & SaaS / container-orchestration

package-ecosystem

github.com/nuclio/nuclio

OSS Libraries

Exploitability

Official Patch Available

References

https://github.com/nuclio/nuclio/security/advisories/GHSA-95fj-3w7g-4r27

github.com

https://github.com/nuclio/nuclio/pull/4030

github.com

https://github.com/nuclio/nuclio/commit/5352d7e16cf92f4350a2f8d806c4b80b626b5c5a

github.com

and 3 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-29042 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows