UnratedPublic exploit

Unauthenticated Path Traversal Arbitrary File Write in Nuclio Dashboard

IdentifiersCVE-2026-52832CWE-22

CVE-2026-52832 is an unauthenticated path traversal vulnerability in the Nuclio Dashboard API. The flaw is associated with handling of the function specification field spec.handler, where insufficient validation of handler-derived paths allows traversal outside the intended directory boundary during the build or source-file creation workflow. By supplying crafted path elements in spec.handler, a remote attacker can cause the Dashboard to write attacker-controlled content to arbitrary filesystem locations accessible to the Dashboard process. Because the Dashboard process runs as root in the affected deployment context, the vulnerability can result in high-impact arbitrary file write within the container and create conditions for broader compromise.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to write arbitrary files to locations writable by the Nuclio Dashboard process. Since the process runs as root, this can enable modification of sensitive files inside the container, tampering with application state, and establishment of persistence within the container context. In Kubernetes deployments, the resulting access may also facilitate follow-on abuse of the mounted service account credentials to create or modify workloads in the namespace, potentially expanding the compromise beyond the Dashboard container.

Mitigation

If you can’t patch tonight, do this now.

Until patched, enable authentication on the Nuclio Dashboard by configuring NUCLIO_AUTH_KIND to a non-NOP mode, restrict access to the Dashboard API and management port to trusted administrative networks only, and avoid direct internet exposure. Running the Dashboard container as a non-root user can reduce the severity of arbitrary file write impact. Additional compensating controls include network segmentation, ingress filtering, and minimizing Kubernetes permissions available to the Dashboard service account.

Remediation

Patch, then assume compromise.

Upgrade Nuclio to version 1.16.5 or later. The corrective action should ensure canonical path resolution and boundary enforcement after deriving the destination path from spec.handler, or reject handler module names containing path separators or traversal sequences before any file write occurs. Validate that the deployed Dashboard version includes the fix and redeploy affected instances as needed.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

CVE-2026-52832-PoC-exploit-nuclio-dashboardMaturityOperationalVerified exploit

Small PoC repository with 3 files: LICENSE, README.md, and a single Bash exploit script at poc/poc.sh. The repository targets CVE-2026-52832 / GHSA-wpcj-rmv4-86qg in Nuclio Dashboard <= 1.15.27. The exploit abuses unauthenticated POST /api/functions when Dashboard runs in default NOP auth mode. By supplying a crafted spec.handler traversal string and base64 content in spec.build.functionSourceCode, the attacker causes the Dashboard build process to write arbitrary content to a chosen path outside the build temp directory, as root, inside the container filesystem. The Bash script is operational rather than just demonstrative: it accepts a target base URL and container name, optionally creates a project via POST /api/projects, constructs a malicious JSON body, sends it to POST /api/functions, then polls using local docker exec to verify that the marker file was created in /tmp. The verification step is local-only and not part of the remote exploit path. No RCE payload is included; the capability demonstrated is arbitrary file write. The README provides lab setup for vulnerable and patched Docker images, expected behavior, impact, and remediation guidance.

mdvpatDisclosed Jul 29, 2026bashmarkdownnetworkwebcontainer

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

NuclioNuclioapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity