{"id":"CVE-2026-52831","summary":"Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE","details":"Nuclio is a \"Serverless\" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, \u003ccommand\u003e). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This issue has been patched in version 1.16.4.","aliases":["GHSA-v5px-423j-pf7p","GO-2026-5946"],"modified":"2026-09-04T03:47:29.990292435Z","published":"2026-09-02T16:40:28.765Z","related":["openSUSE-SU-2026:21483-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52831.json"},"references":[{"type":"WEB","url":"https://github.com/nuclio/nuclio/releases/tag/1.16.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52831.json"},{"type":"ADVISORY","url":"https://github.com/nuclio/nuclio/security/advisories/GHSA-v5px-423j-pf7p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52831"},{"type":"FIX","url":"https://github.com/nuclio/nuclio/commit/3356b86a8bfab3f960aa420310ebff765df9dede"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nuclio/nuclio","events":[{"introduced":"0"},{"fixed":"3356b86a8bfab3f960aa420310ebff765df9dede"},{"fixed":"19b495069eba827f39ecfc9bfb46b3faefab17f9"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.16.4"}]}}],"versions":["1.16.3","1.16.2","1.16.0","1.15.25","1.15.24","1.15.23","1.15.22","1.15.21","1.15.20","1.15.19","1.15.18","1.15.17","1.15.16","1.15.15","1.15.14","1.15.13","1.15.12","1.15.11","1.15.10","1.15.9","1.15.8","1.15.3","1.15.2","1.15.1","1.14.8","1.14.7","1.14.6","1.14.5","1.14.3","2.0.0","1.14.2","1.14.1","1.14.0","1.13.4","1.13.3","1.13.2","1.13.1","1.13.0","1.12.14","1.12.13","1.12.12","1.12.11","1.12.10","1.12.9","1.12.8","1.12.7","1.12.6","1.12.5","1.12.4","1.12.3","1.12.2","1.12.1","1.12.0","1.11.24","1.11.23","1.11.22","1.11.21","1.11.20","1.11.19","1.11.18","1.11.17","1.11.16","1.11.15","1.11.14","1.11.13","1.11.12","1.11.11","1.11.10","1.11.9","1.11.8","1.11.7","1.11.6","1.11.5","1.11.4","1.11.3","1.11.2","1.11.1","1.11.0","1.10.8","1.10.7","1.10.6","1.10.5","1.10.4","1.10.3","1.10.2","1.10.1","1.10.0","1.9.1","1.9.0","1.8.17","1.8.16","1.8.15","1.8.14","1.8.13","1.8.12","1.8.11","1.8.10","1.8.9","1.8.8","1.8.7","1.8.6","1.8.5","1.8.4","1.8.3","1.8.2","1.8.1","1.8.0","1.7.11","1.7.10","1.7.9","1.7.8","1.7.7","1.7.6","1.7.5","1.7.4","1.7.3","1.7.2","1.7.1","1.7.0","1.6.30","1.6.29","1.6.28","1.6.27","1.6.26","1.6.25","1.6.24","1.6.23","1.6.22","1.6.21","1.6.20","1.6.19","1.6.18","1.6.17","1.6.16","1.6.15","1.6.14","1.6.13","1.6.12","1.6.11","1.6.10","1.6.9","1.6.8","1.6.7","1.6.6","1.6.5","1.6.4","1.6.3","1.6.2","1.6.1","1.6.0","1.5.16","1.5.15","1.5.14","1.5.13","1.5.12","1.5.11","1.5.10","1.5.9","1.5.8","8.8.8","1.5.7","1.5.6","1.5.5","1.5.4","1.5.3","1.5.2","1.5.1","1.5.0","1.4.17","1.4.16","1.4.15","1.4.14","1.4.13","1.4.12","1.4.11","1.4.10","1.4.9","1.4.8","1.4.7","1.4.6","1.4.5","1.4.4","1.4.3","1.4.2","1.4.1","1.4.0","1.3.22","1.3.21","1.3.20","1.3.19","1.3.18","1.3.17","1.3.16","1.3.15","1.3.14","1.3.13","1.3.12","1.3.11","1.3.10","1.3.9","1.3.8","1.3.7","1.3.6","1.3.5","1.3.4","1.3.3","1.3.2","1.3.1","1.3.0","1.2.3","1.2.2","1.2.0","1.1.20","1.1.19","1.1.18","1.1.17","1.1.16","1.1.15","1.1.14","1.1.13","1.1.10","1.1.9","1.1.8","1.1.7","1.1.6","1.1.5","1.1.3","1.1.2","1.1.1","1.1.0","1.0.1","1.0.0","0.7.11","0.7.10","0.7.9","0.7.8","0.7.7","0.7.6","0.7.5","0.7.4","0.7.3","0.7.2","0.7.0","0.5.15","0.5.14","0.5.13","0.5.12","0.5.11","0.5.10","0.5.9","0.5.8","0.5.7","0.5.6","0.5.5","0.5.4","0.5.3","0.5.2","0.5.1","0.5.0","0.4.0","0.3.4","0.3.3","0.3.2","0.3.1","0.3.0","0.2.9","0.2.8","0.2.7","0.2.6","0.2.5","0.2.4","0.2.3","0.2.2","0.2.1","0.2.0","0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52831.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"}]}