CVE-2026-52832-PoC-exploit-nuclio-dashboard

Nuclio Dashboard (NOP mode) accepts unauthenticated POST /api/functions. The spec.handler field isn't path-validated, so ../../../../tmp/x.txt:handler escapes the build tempdir via path.Join, letting an attacker write arbitrary content to any path as root. (CVE-2026-52832, ≤1.15.27)

CVE-2026-52832 Nuclio Dashboard Path Traversal → Arbitrary File Write

Unauthenticated arbitrary file write (as root) in Nuclio Dashboard via path traversal in spec.handler.

Summary

Nuclio Dashboard in default NOP auth mode accepts POST /api/functions without authentication. The spec.handler field (module:entrypoint) is not path-validated, so a value like ../../../../tmp/x.txt:handler escapes the build tempdir via path.Join(tempDir, moduleFileName), letting an attacker write arbitrary base64 content (spec.build.functionSourceCode) to any path in the Dashboard container. The process runs as uid=0 (root).

Lab Setup

Vulnerable target: ``` docker run -d --name nuclio-vuln -p 127.0.0.1:8070:8070
-v /var/run/docker.sock:/var/run/docker.sock
quay.io/nuclio/dashboard:1.15.27-amd64 ```

Patched control: ``` docker run -d --name nuclio-patched -p 127.0.0.1:8071:8070
-v /var/run/docker.sock:/var/run/docker.sock
quay.io/nuclio/dashboard:1.16.5-amd64 ```

Wait until curl http://127.0.0.1:8070/api/functions returns 200 {}.

Run on a local target

``` ./poc/poc.sh http://127.0.0.1:8070 nuclio-vuln ```

Expected: [+] SUCCESS an innocuous marker file is written outside the build tempdir, owned by root.

Against the patched image the same request is rejected with HTTP 500 and Handler module name resolves outside the build directory, and no file is created.

Example : Run locally with Docker

1. start vulnerable target

docker run -d --name nuclio-vuln -p 127.0.0.1:8070:8070
-v /var/run/docker.sock:/var/run/docker.sock
quay.io/nuclio/dashboard:1.15.27-amd64

2. wait until it answers

curl http://127.0.0.1:8070/api/functions # expect: {}

3. run

chmod +x poc.sh ./poc.sh http://127.0.0.1:8070 nuclio-vuln

Impact

An unauthenticated network attacker can create or overwrite any file with arbitrary content in the Dashboard container's filesystem as root.

Remediation

Upgrade to Nuclio ≥ 1.16.5, which adds common.IsPathWithinDir before os.WriteFile in pkg/processor/build/builder.go. Additionally: enable authentication instead of NOP, restrict network access to the Dashboard, and avoid mounting the Docker socket where not required.

Disclaimer

For authorized security research and defensive purposes only. The included PoC writes only a harmless timestamped marker file. Do not run against systems you do not own or have permission to test.