CVE-2026-79755 nuclio CVE debrief

Who should care

Users of Nuclio Serverless framework, especially those using the local Docker platform, should apply the patch in version 1.17.4. Security teams monitoring for remote code execution risks and Docker container security should prioritize this CVE.

Technical summary

CVE-2026-79755 is a HIGH-severity vulnerability in Nuclio's local Docker platform. Unvalidated namespace input is interpolated into a docker ps command, allowing remote attackers to inject OS commands as root. This is possible due to the default 'nop' authentication kind. The vulnerability was patched in Nuclio version 1.17.4. To mitigate this vulnerability, users should review and apply the patch, implement additional authentication mechanisms, monitor deployments, restrict access, and perform regular vulnerability assessments.

Defensive priority

CVE-2026-79755 is rated HIGH with a CVSS score of 8; remote attackers can inject OS commands as root, leading to potential host compromise through the dashboard container.

Recommended defensive actions

• Review and apply Nuclio version 1.17.4 or later to ensure patched functionality.
• Implement additional authentication mechanisms beyond the default 'nop' setting.
• Monitor Nuclio deployments for suspicious activity and ensure proper isolation.
• Restrict access to the dashboard container and Docker socket.
• Perform regular vulnerability assessments and penetration testing.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-79755 issue arises from unvalidated user input in Nuclio's local Docker platform, allowing remote command injection as root due to the default 'nop' authentication kind. This vulnerability can be exploited by remote attackers to inject arbitrary OS commands that run as root inside the dashboard container, which holds the Docker socket, potentially leading to host compromise. To verify and mitigate this vulnerability, defenders should review Nuclio deployments, ensure proper isolation, restrict access to the dashboard container and Docker socket, and perform regular vulnerability assessments and penetration testing. Additionally, implementing additional authentication mechanisms beyond the default 'nop' setting is crucial. Users should apply the patch in version 1.17.4 or later to ensure patched functionality.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.