CVE-2026-52832

4.9 Moyenne

Publiée le 02/09/2026 à 19:17 · Modifiée le 09/09/2026 à 23:04 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion. This issue has been patched in version 1.16.5.

Traduire en français

Produits concernés

nuclio

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.9 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N`

Faiblesses (CWE)

CWE-22

Références

https://github.com/nuclio/nuclio/commit/2a55d3a8bd4d49226cb4742020303f5bf2a0931d
https://github.com/nuclio/nuclio/pull/4143
https://github.com/nuclio/nuclio/releases/tag/1.16.5
https://github.com/nuclio/nuclio/security/advisories/GHSA-wpcj-rmv4-86qg
https://github.com/nuclio/nuclio/security/advisories/GHSA-wpcj-rmv4-86qg

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories